Windows Analysis Report
iGhDjzEiDU.exe

AI detected suspicious sample

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\graias\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: iGhDjzEiDU.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0043294A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

5_2_0043294A

Source: iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f5ba9315-5

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00406764 _wcslen,CoGetObject,

5_2_00406764

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: iGhDjzEiDU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: iGhDjzEiDU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BasicDisplay.pdb source: dxdiag.exe, 00000021.00000003.2105510977.0000000005721000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000021.00000003.2048401566.00000000031DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BasicDisplay.pdbUGP source: dxdiag.exe, 00000021.00000003.2105510977.0000000005721000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000021.00000003.2048401566.00000000031DF000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040B335
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041B43F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	5_2_0041B43F
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040B53A
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	5_2_004089A9
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,	5_2_00406AC2
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	5_2_00407A8C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00418C79 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00418C79
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	5_2_00408DA7
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_100010F1
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0040AE51 FindFirstFileW,FindNextFileW,	38_2_0040AE51
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	39_2_00407EF8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	41_2_00407898

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_00406F06

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49733 -> 185.234.72.215:4444
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 185.234.72.215:4444 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.234.72.215

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 185.234.72.215:4444

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: COMBAHTONcombahtonGmbHDE COMBAHTONcombahtonGmbHDE

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49735 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.215

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00426107 recv,

5_2_00426107

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: graias.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: graias.exe, 00000026.00000002.2107594386.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: graias.exe, 00000026.00000002.2107594386.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: graias.exe, 00000008.00000002.2395821295.00000000011E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, iGhDjzEiDU.exe, 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: bhvC4F2.tmp.38.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_157.13.dr	String found in binary or memory: http://schema.org/Organization
Source: iGhDjzEiDU.exe, 00000000.00000002.1684799990.0000000003141000.00000004.00000800.00020000.00000000.sdmp, graias.exe, 00000006.00000002.1717497130.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: graias.exe, 00000026.00000002.2105157332.0000000000D73000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: chpC919.tmp.38.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_157.13.dr, chromecache_191.13.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_157.13.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_157.13.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_157.13.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: chpC919.tmp.38.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chpC919.tmp.38.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chpC919.tmp.38.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: chpC919.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chpC919.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chpC919.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_157.13.dr	String found in binary or memory: https://github.com/nschonni
Source: chromecache_157.13.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: graias.exe, 00000026.00000002.2106207732.000000000100F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: graias.exe, 00000026.00000002.2106207732.000000000100F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: graias.exe, 00000026.00000002.2107594386.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
Source: graias.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_190.13.dr	String found in binary or memory: https://schema.org
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_190.13.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: chpC919.tmp.38.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: graias.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: chpC919.tmp.38.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_169.13.dr, chromecache_190.13.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

5_2_004099E4

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Graias\graias.exe
Source: C:\Windows\SysWOW64\dxdiag.exe	Windows user hook set: 0 mouse low level C:\Windows\System32\dinput8.dll

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_004159C6

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	5_2_004159C6
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	38_2_0040987A
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	38_2_004098E2
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	39_2_00406DFC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	39_2_00406E9F
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	41_2_004068B5
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	41_2_004072B5

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_004159C6

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

5_2_00409B10

Source: C:\Windows\SysWOW64\dxdiag.exe

Windows user hook set: 0 mouse low level C:\Windows\System32\dinput8.dll

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\graias\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041BB81 SystemParametersInfoW,		5_2_0041BB81
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041BB87 SystemParametersInfoW,		5_2_0041BB87

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,	38_2_0040DD85
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00401806 NtdllDefWindowProc_W,	38_2_00401806
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_004018C0 NtdllDefWindowProc_W,	38_2_004018C0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004016FD NtdllDefWindowProc_A,	39_2_004016FD
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004017B7 NtdllDefWindowProc_A,	39_2_004017B7
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00402CAC NtdllDefWindowProc_A,	41_2_00402CAC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00402D66 NtdllDefWindowProc_A,	41_2_00402D66

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,

5_2_004158B9

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_01325E6C	0_2_01325E6C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_01327AA8	0_2_01327AA8
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_05528728	0_2_05528728
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_05528718	0_2_05528718
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0797E760	0_2_0797E760
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_079766BC	0_2_079766BC
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_079733F0	0_2_079733F0
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_07974FB0	0_2_07974FB0
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0797E752	0_2_0797E752
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0797A1E8	0_2_0797A1E8
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_07991F1C	0_2_07991F1C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_079929C0	0_2_079929C0
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004520E2	5_2_004520E2
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041D081	5_2_0041D081
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043D0A8	5_2_0043D0A8
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00437160	5_2_00437160
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004361BA	5_2_004361BA
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00426264	5_2_00426264
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00431387	5_2_00431387
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043652C	5_2_0043652C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041E5EF	5_2_0041E5EF
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0044C749	5_2_0044C749
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004367D6	5_2_004367D6
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004267DB	5_2_004267DB
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043C9ED	5_2_0043C9ED
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00432A59	5_2_00432A59
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00436A9D	5_2_00436A9D
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043CC1C	5_2_0043CC1C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00436D58	5_2_00436D58
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00434D32	5_2_00434D32
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043CE4B	5_2_0043CE4B
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00440E30	5_2_00440E30
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00426E83	5_2_00426E83
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00412F45	5_2_00412F45
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00452F10	5_2_00452F10
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00426FBD	5_2_00426FBD
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_00EB5E6C	6_2_00EB5E6C
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_00EB7AA8	6_2_00EB7AA8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_02918728	6_2_02918728
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_029186C5	6_2_029186C5
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D066BC	6_2_06D066BC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0E760	6_2_06D0E760
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D033F0	6_2_06D033F0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D04FB0	6_2_06D04FB0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0E752	6_2_06D0E752
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0A1E8	6_2_06D0A1E8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D21F1C	6_2_06D21F1C
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D229C0	6_2_06D229C0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D21F10	6_2_06D21F10
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E08719	6_2_06E08719
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E03FC1	6_2_06E03FC1
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E03FD0	6_2_06E03FD0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E003BB	6_2_06E003BB
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E03B98	6_2_06E03B98
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E03760	6_2_06E03760
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E05768	6_2_06E05768
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E05758	6_2_06E05758
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E03328	6_2_06E03328
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E07820	6_2_06E07820
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E0B1C8	6_2_06E0B1C8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10017194	8_2_10017194
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_1000B5C1	8_2_1000B5C1
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044B040	38_2_0044B040
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0043610D	38_2_0043610D
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00447310	38_2_00447310
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044A490	38_2_0044A490
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0040755A	38_2_0040755A
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0043C560	38_2_0043C560
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044B610	38_2_0044B610
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044D6C0	38_2_0044D6C0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_004476F0	38_2_004476F0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044B870	38_2_0044B870
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044081D	38_2_0044081D
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00414957	38_2_00414957
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_004079EE	38_2_004079EE
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00407AEB	38_2_00407AEB
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044AA80	38_2_0044AA80
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00412AA9	38_2_00412AA9
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00404B74	38_2_00404B74
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00404B03	38_2_00404B03
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044BBD8	38_2_0044BBD8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00404BE5	38_2_00404BE5
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00404C76	38_2_00404C76
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00415CFE	38_2_00415CFE
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00416D72	38_2_00416D72
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00446D30	38_2_00446D30
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00446D8B	38_2_00446D8B
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00406E8F	38_2_00406E8F
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00405038	39_2_00405038
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0041208C	39_2_0041208C
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004050A9	39_2_004050A9
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0040511A	39_2_0040511A
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0043C13A	39_2_0043C13A
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004051AB	39_2_004051AB
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00449300	39_2_00449300
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0040D322	39_2_0040D322
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0044A4F0	39_2_0044A4F0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0043A5AB	39_2_0043A5AB
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00413631	39_2_00413631
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00446690	39_2_00446690
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0044A730	39_2_0044A730
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004398D8	39_2_004398D8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_004498E0	39_2_004498E0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0044A886	39_2_0044A886
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0043DA09	39_2_0043DA09
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00438D5E	39_2_00438D5E
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00449ED0	39_2_00449ED0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0041FE83	39_2_0041FE83
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00430F54	39_2_00430F54
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004050C2	41_2_004050C2
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004014AB	41_2_004014AB
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00405133	41_2_00405133
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004051A4	41_2_004051A4
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00401246	41_2_00401246
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_0040CA46	41_2_0040CA46
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00405235	41_2_00405235
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004032C8	41_2_004032C8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00401689	41_2_00401689
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00402F60	41_2_00402F60

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 00422297 appears 42 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 00444B5A appears 37 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 00413025 appears 79 times
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: String function: 00416760 appears 69 times
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: String function: 004020E7 appears 39 times
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: String function: 004338B5 appears 41 times
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: String function: 00433FC0 appears 55 times

Source: iGhDjzEiDU.exe	Binary or memory string: OriginalFilename vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1681031697.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000000.1643420254.0000000000C60000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEPoD.exe2 vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1715778624.0000000009470000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1712515053.0000000007873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1714219089.0000000007940000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000000.00000002.1684799990.0000000003194000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe, 00000005.00000002.1683664559.0000000000B78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs iGhDjzEiDU.exe
Source: iGhDjzEiDU.exe	Binary or memory string: OriginalFilenameEPoD.exe2 vs iGhDjzEiDU.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\mstee.sys

Source: iGhDjzEiDU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: iGhDjzEiDU.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: graias.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: _0020.SetAccessControl
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: _0020.AddAccessRule
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, oirEpTQk4AEyLHDkvV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: _0020.SetAccessControl
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	Security API names: _0020.AddAccessRule
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, oirEpTQk4AEyLHDkvV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@176/88@11/6

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Code function: 38_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

38_2_004182CE

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		5_2_00416AB7
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,		41_2_00410DE1

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Code function: 38_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

38_2_00418758

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0040E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

5_2_0040E219

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0041A64F FindResourceA,LoadResource,LockResource,SizeofResource,

5_2_0041A64F

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00419BD4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_00419BD4

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iGhDjzEiDU.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-O844B9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogwhplav.jo4.ps1

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs"

Source: iGhDjzEiDU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: iGhDjzEiDU.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: graias.exe, graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: graias.exe, graias.exe, 00000027.00000002.2092543651.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: graias.exe, graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: graias.exe, graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: graias.exe, graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: graias.exe, 00000026.00000002.2107861434.0000000002ABF000.00000004.00000020.00020000.00000000.sdmp, chpC949.tmp.38.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: graias.exe, graias.exe, 00000026.00000002.2104616476.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: iGhDjzEiDU.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

File read: C:\Users\user\Desktop\iGhDjzEiDU.exe

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,13104816673025473941,13422850102401617178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2052,i,5101334319077942357,3031038982098258924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=2016,i,6952115490064793543,9344193390170368015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,6037255309931644860,773684642686352873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,6741851451867710431,3176181943120798108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1984,i,6477219484691926715,17097649623628388741,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1956,i,397094272896585161,9213667926170046926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\System32\dxdiag.exe" /t C:\Users\user\AppData\Local\Temp\sysinfo.txt
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1984,i,15953286615006375795,524760772625708092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\orbocvcopxyxxqzovbukeapdendakrxtoq"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1896,i,8025100827868505226,8846340673771724363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,14003735333465884459,4249736709750483152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1996,i,9861328130371480487,5472941936562496665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,14451717029141036046,9817444519185968189,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1980,i,13194812879482372137,17589311234174251836,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,4041789208375361090,5104077722080206453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1900,i,964775095578921725,9120990377794690672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs"
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\System32\dxdiag.exe" /t C:\Users\user\AppData\Local\Temp\sysinfo.txt
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\orbocvcopxyxxqzovbukeapdendakrxtoq"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,13104816673025473941,13422850102401617178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2052,i,5101334319077942357,3031038982098258924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=2016,i,6952115490064793543,9344193390170368015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,6037255309931644860,773684642686352873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,6741851451867710431,3176181943120798108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1984,i,6477219484691926715,17097649623628388741,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1956,i,397094272896585161,9213667926170046926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1984,i,15953286615006375795,524760772625708092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1896,i,8025100827868505226,8846340673771724363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,14003735333465884459,4249736709750483152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1996,i,9861328130371480487,5472941936562496665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,14451717029141036046,9817444519185968189,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1980,i,13194812879482372137,17589311234174251836,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,4041789208375361090,5104077722080206453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1900,i,964775095578921725,9120990377794690672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dxdiagn.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: d3d12.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wmiclnt.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dsound.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: devrtl.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: spinf.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: drvstore.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: spfileq.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wifidisplay.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mfplat.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: rtworkq.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mf.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mfcore.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: ksuser.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mfperfhelper.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: mfsensorgroup.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: comppkgsup.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: windows.media.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\dxdiag.exe	Section loaded: appxdeploymentclient.dll

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: iGhDjzEiDU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: iGhDjzEiDU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: BasicDisplay.pdb source: dxdiag.exe, 00000021.00000003.2105510977.0000000005721000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000021.00000003.2048401566.00000000031DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BasicDisplay.pdbUGP source: dxdiag.exe, 00000021.00000003.2105510977.0000000005721000.00000004.00000020.00020000.00000000.sdmp, dxdiag.exe, 00000021.00000003.2048401566.00000000031DF000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.iGhDjzEiDU.exe.7940000.6.raw.unpack, MainForm.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	.Net Code: kkJatZJNv4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	.Net Code: kkJatZJNv4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.iGhDjzEiDU.exe.33d9654.0.raw.unpack, MainForm.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 6.2.graias.exe.2e09748.2.raw.unpack, MainForm.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0041BCF3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

5_2_0041BCF3

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0552B200 push eax; retf	0_2_0552B319
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0797E19D push 8B000001h; iretd	0_2_0797E1CC
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 0_2_0797E1D7 push 8B000001h; iretd	0_2_0797E1DD
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00434006 push ecx; ret	5_2_00434019
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004567F0 push eax; ret	5_2_0045680E
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0045B9DD push esi; ret	5_2_0045B9E6
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00455EBF push ecx; ret	5_2_00455ED2
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_0291B200 push eax; retf	6_2_0291B319
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0C8B0 push es; ret	6_2_06D0C8C0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0E1D7 push 8B000001h; iretd	6_2_06D0E1DD
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06D0E19D push 8B000001h; iretd	6_2_06D0E1CC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E07EE8 push esp; retf	6_2_06E07EF5
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E003B8 push eax; ret	6_2_06E003B9
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E07F80 pushfd ; retf	6_2_06E07F8D
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 6_2_06E069A9 pushad ; retf	6_2_06E069B5
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10002806 push ecx; ret	8_2_10002819
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10009FD8 push esi; ret	8_2_10009FD9
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044693D push ecx; ret	38_2_0044694D
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044DB70 push eax; ret	38_2_0044DB84
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0044DB70 push eax; ret	38_2_0044DBAC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_00451D54 push eax; ret	38_2_00451D61
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0044B090 push eax; ret	39_2_0044B0A4
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_0044B090 push eax; ret	39_2_0044B0CC
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00444E71 push ecx; ret	39_2_00444E81
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00414060 push eax; ret	41_2_00414074
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00414060 push eax; ret	41_2_0041409C
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00414039 push ecx; ret	41_2_00414049
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_004164EB push 0000006Ah; retf	41_2_004165C4
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00416553 push 0000006Ah; retf	41_2_004165C4
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00416555 push 0000006Ah; retf	41_2_004165C4

Source: iGhDjzEiDU.exe	Static PE information: section name: .text entropy: 7.85185407933489
Source: graias.exe.5.dr	Static PE information: section name: .text entropy: 7.85185407933489

Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, KsWaPvY6iMkFaFMqkR.cs	High entropy of concatenated method names: 'Dispose', 'RaE1DET5eZ', 'mFiHVS7Nkf', 'tOv8Sfr0Bu', 'rmX1opAG1K', 'huw1zye41K', 'ProcessDialogKey', 'HHBH0YEfDO', 'HqWH1lx3E1', 'bQ7HHXoIey'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, ISax0UGT6r9T28RYAO.cs	High entropy of concatenated method names: 'I3fc2i9nvL', 'OnvcJAeYSL', 'pr1ct6ebDa', 'qL1c7FVf1B', 'qKccE2CF6V', 'amtcS3XqdL', 'RWjcvsXoa4', 'wK0cQna2hg', 'GCYcLCexat', 'Cc0cXwYLbv'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, TcFXyGaNoLGVFHtkq0.cs	High entropy of concatenated method names: 'mEI1cirEpT', 'V4A1KEyLHD', 'HXf1xq0PeF', 'qWs163UEQb', 'zSr1IiPy3h', 'YAF1ytn9ui', 'ptWT28AKfgnuTGOjHu', 'BiBBHQ6UxLYlWm4UAX', 'FLv11ZCRg4', 'R4M1fDx9FU'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	High entropy of concatenated method names: 'AEPfnHer6t', 'MJdfFJEvup', 'ITBfYKTtEy', 'S0Of50C1uj', 'Y0BfPWq66m', 'FNdfCFDKDl', 'iUQfcExu0H', 'rg2fKMehIO', 'LPhfB3Du4t', 'pFrfxTUOys'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, oirEpTQk4AEyLHDkvV.cs	High entropy of concatenated method names: 'C6FYh5MNiq', 'IvvYjTrBxL', 'BoMYqYVEHh', 'uq2YwAjpuj', 'yPpYU6Sew4', 'TX4Y9Sy8gm', 'kq2YkOH4Yl', 'fvEYdNOwUg', 'ttOYDkNP0y', 'LcQYotSVrQ'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, yUNEYV11fRq26bsPudC.cs	High entropy of concatenated method names: 'JLLioc94EI', 'BJLizcnH2u', 'lEvA0PirD8', 'kuoA1PDOH0', 'omBAHBdKdB', 'LesAfV7dU5', 'GIRAaUBJ1x', 'FTOAnIOJbV', 'kMoAFARjRR', 'v9FAYndEnU'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, FoIey2oob8woPkHgxe.cs	High entropy of concatenated method names: 'juYi5KlJ4i', 'o44iPVpbMV', 'DypiChV5u1', 'vwyicqyw8t', 'HZpibCdgkO', 'cwRiK7jLE5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, CXF3dbOvOPd1Ho0I5P.cs	High entropy of concatenated method names: 'cOTRQv66sl', 'fccRLw4QQn', 'bB6RZfcJDN', 'iTTRV6CaSh', 'FCwRernfdH', 'KuQR3OTIM1', 'nfBRr5vONF', 'TjORmGPuGD', 'KMlRTyU85x', 'XGwRpNyUY5'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, TEQbsVXqVBlwj7SriP.cs	High entropy of concatenated method names: 'ornPE5vnCX', 'Qo8Pvcr1au', 'GWL5uYa3Ia', 'l0q5ee8Rc5', 'OkX53gJkgf', 'LP35NU6DtG', 'OHD5r4vvO1', 'UGD5muM35A', 'lqr5Gg37Ig', 'uGf5TxxuY4'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, sL6QMr10ElDaIL5m1Yb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'eRaipbQLj5', 'KWUiWopZwi', 'z8biOwmQ67', 'PU2ih0QFUf', 'qHIijc2vau', 'Bauiqcjc3W', 'EP7iwYeWVW'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, CFmuHgz2uGmCodnc7W.cs	High entropy of concatenated method names: 'YAIiS0arfP', 'OC5iQfi9dn', 'WQdiLj9wO0', 'tJZiZveKka', 'VYHiVIm9v9', 'nAnieNam4i', 'JPoi3idXG7', 'KXti4fK9hA', 'xIUi26yaed', 'xhdiJ6vNHR'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, p3hoAFZtn9uiwEtfKN.cs	High entropy of concatenated method names: 'RNXCnJGTyk', 'QHECYGqyOs', 'ar6CPcoWNM', 'zHYCc0nWBF', 'LKaCKwrj56', 'oIkPU9ZU0L', 'hESP9O2J0K', 'arbPkqvrC7', 'dg8Pdx294o', 'c9PPDwQO1B'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, gyjADuLXfq0PeFsWs3.cs	High entropy of concatenated method names: 'qXa57AUKsP', 'X8b5SX3S8P', 'D4e5Qui8rs', 'qal5LYEuXZ', 'YZS5IM8QUF', 'coY5yLO0Ck', 'Dji5sJRCEC', 'Swn5gU3Y1B', 'mSx5bjF3qG', 'tuT5ioAkbN'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, tkV5WJwR3JlKYuw1Ej.cs	High entropy of concatenated method names: 'i13sxxg6ye', 'UAVs6J3jGf', 'ToString', 'dbasFI3BwU', 'rinsYdeWB0', 'Tf5s5mM5S2', 'MjjsPa6l1u', 'zLosCVjQIU', 'pyBscPQmod', 'YMYsKVQPUq'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, kwsnHd3D9pAL148Rf1.cs	High entropy of concatenated method names: 'Ww7Cr9HDP4', 'JyXCGflTi1', 'o9bCNt1ek6', 'P6vF0u2qBx4QxnA3ypc', 'sBToKX2sXGUnADsyPYF', 'vn1peu2JbdLT0xPgfWw', 'aBU0bj25uZPwellOY9b'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, gytIsVqF8MuD80NBw2.cs	High entropy of concatenated method names: 'ToString', 'B3ZypCGBEI', 'UR8yV8hA2f', 's8dyuu4h7x', 'Y0ZyeegDkT', 'KViy3klWnG', 'qrayNtstaX', 'C78yr3tCcQ', 'N3TymAgHAG', 'lQiyGZ8aVf'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, tEdNnMhdKHTbHQJoVm.cs	High entropy of concatenated method names: 'Gq7IT2NZHb', 'ltmIW0mRqy', 'DBoIhoCgwh', 'pE0Ij51JqK', 'mNpIV7k43K', 'Q4NIuFl2o8', 'Y37IeN6Ojp', 'rtRI3rsCam', 'H2xINubJte', 'uVFIrTSUCR'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, X8yytkHu8Bt1Puv27C.cs	High entropy of concatenated method names: 'b3rthX3x6', 'XvD71dNM5', 'nsrSV6jgQ', 'ckmvFVKmh', 'KNXL7DoN3', 'SNFXRtKA9', 'm1UPrMjudABTcAeQdC', 'ROeEnGwqnr0vnvXW64', 'oL6gqcnLb', 'Jd5ir5J6E'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, lYEfDODVqWlx3E11Q7.cs	High entropy of concatenated method names: 'LmrbZAovvH', 'SAdbVbiVyL', 'Ac2busbPge', 'AQCbe6rNkP', 'rN6b3pBW4s', 'Xp1bNK4Qlj', 'NtBbrupSXv', 'Oirbm8EG1p', 'FMMbG2N9R5', 'M9dbTB7Guj'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, oeCGxP9hPhHPGyyRta.cs	High entropy of concatenated method names: 'gSSsdqGo6G', 'TBwso4h8y4', 'zoog03AtDp', 'eM4g1nnf9E', 'D6RspcoAxE', 'r18sWR0yaW', 'AZ7sOJUllt', 'FDcshYvoM7', 'PMUsjKT1fg', 'w0qsqMSvAD'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, l7uwjVkLYhaEET5eZg.cs	High entropy of concatenated method names: 'NOPbISmEgt', 'SqEbsaGFuc', 'ydEbbUTwDy', 'yQnbA06cqO', 'weVbMNqY8Z', 'dheb4Dn24b', 'Dispose', 'xprgFKONB6', 'D2hgYS5HIO', 'ePwg5uZIof'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, YHIc1t1agveHGox9DlV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FeJ8bLFk34', 'jBp8iI1EXi', 'TLF8AYB7lO', 'MvX88XLL9T', 'uYE8MjLSpx', 'GUK8l9Oiuc', 'KFa84hWtwZ'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, o8MKfyrc7cYmq4eBVV.cs	High entropy of concatenated method names: 'h3qcFprRJn', 'K88c5beY6q', 'UK3cCfNcyZ', 'YQeCoeDoyO', 'KlZCzgpIw6', 'lW4c05FZuf', 'nNhc1DSxVO', 'NiXcHQX0ae', 'ps3cf7Eoys', 'Qywcaj27OC'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, lrQBfVV0rfHwgJoiLc.cs	High entropy of concatenated method names: 'QxRD9x24HcpebWts3CO', 'zUuf1R2QGuCeiVxJAeX', 'oI2vLD2N9ki0sTnF8PY', 'MgGCgSkenW', 'XO1CbdnCJC', 'Fq7Ci4HLLp', 'G1Ziwk2oXKuyB5fhbHT', 'Vh3KG12FCYQHR4jRI22'
Source: 0.2.iGhDjzEiDU.exe.9470000.7.raw.unpack, gT1bvP5O25dwYsGRwM.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'nw9HDdlXL2', 'wsLHoweiE9', 'p0ZHzaHnLQ', 'qUIf0i2bSK', 'vLff1k8hbP', 'q3bfHlOdCo', 'llhff7qIuu', 'CjGF87HPXZBAxrLWIub'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, KsWaPvY6iMkFaFMqkR.cs	High entropy of concatenated method names: 'Dispose', 'RaE1DET5eZ', 'mFiHVS7Nkf', 'tOv8Sfr0Bu', 'rmX1opAG1K', 'huw1zye41K', 'ProcessDialogKey', 'HHBH0YEfDO', 'HqWH1lx3E1', 'bQ7HHXoIey'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, ISax0UGT6r9T28RYAO.cs	High entropy of concatenated method names: 'I3fc2i9nvL', 'OnvcJAeYSL', 'pr1ct6ebDa', 'qL1c7FVf1B', 'qKccE2CF6V', 'amtcS3XqdL', 'RWjcvsXoa4', 'wK0cQna2hg', 'GCYcLCexat', 'Cc0cXwYLbv'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, TcFXyGaNoLGVFHtkq0.cs	High entropy of concatenated method names: 'mEI1cirEpT', 'V4A1KEyLHD', 'HXf1xq0PeF', 'qWs163UEQb', 'zSr1IiPy3h', 'YAF1ytn9ui', 'ptWT28AKfgnuTGOjHu', 'BiBBHQ6UxLYlWm4UAX', 'FLv11ZCRg4', 'R4M1fDx9FU'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, GY0wQ6K1nUpCqMVFnw.cs	High entropy of concatenated method names: 'AEPfnHer6t', 'MJdfFJEvup', 'ITBfYKTtEy', 'S0Of50C1uj', 'Y0BfPWq66m', 'FNdfCFDKDl', 'iUQfcExu0H', 'rg2fKMehIO', 'LPhfB3Du4t', 'pFrfxTUOys'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, oirEpTQk4AEyLHDkvV.cs	High entropy of concatenated method names: 'C6FYh5MNiq', 'IvvYjTrBxL', 'BoMYqYVEHh', 'uq2YwAjpuj', 'yPpYU6Sew4', 'TX4Y9Sy8gm', 'kq2YkOH4Yl', 'fvEYdNOwUg', 'ttOYDkNP0y', 'LcQYotSVrQ'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, yUNEYV11fRq26bsPudC.cs	High entropy of concatenated method names: 'JLLioc94EI', 'BJLizcnH2u', 'lEvA0PirD8', 'kuoA1PDOH0', 'omBAHBdKdB', 'LesAfV7dU5', 'GIRAaUBJ1x', 'FTOAnIOJbV', 'kMoAFARjRR', 'v9FAYndEnU'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, FoIey2oob8woPkHgxe.cs	High entropy of concatenated method names: 'juYi5KlJ4i', 'o44iPVpbMV', 'DypiChV5u1', 'vwyicqyw8t', 'HZpibCdgkO', 'cwRiK7jLE5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, CXF3dbOvOPd1Ho0I5P.cs	High entropy of concatenated method names: 'cOTRQv66sl', 'fccRLw4QQn', 'bB6RZfcJDN', 'iTTRV6CaSh', 'FCwRernfdH', 'KuQR3OTIM1', 'nfBRr5vONF', 'TjORmGPuGD', 'KMlRTyU85x', 'XGwRpNyUY5'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, TEQbsVXqVBlwj7SriP.cs	High entropy of concatenated method names: 'ornPE5vnCX', 'Qo8Pvcr1au', 'GWL5uYa3Ia', 'l0q5ee8Rc5', 'OkX53gJkgf', 'LP35NU6DtG', 'OHD5r4vvO1', 'UGD5muM35A', 'lqr5Gg37Ig', 'uGf5TxxuY4'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, sL6QMr10ElDaIL5m1Yb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'eRaipbQLj5', 'KWUiWopZwi', 'z8biOwmQ67', 'PU2ih0QFUf', 'qHIijc2vau', 'Bauiqcjc3W', 'EP7iwYeWVW'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, CFmuHgz2uGmCodnc7W.cs	High entropy of concatenated method names: 'YAIiS0arfP', 'OC5iQfi9dn', 'WQdiLj9wO0', 'tJZiZveKka', 'VYHiVIm9v9', 'nAnieNam4i', 'JPoi3idXG7', 'KXti4fK9hA', 'xIUi26yaed', 'xhdiJ6vNHR'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, p3hoAFZtn9uiwEtfKN.cs	High entropy of concatenated method names: 'RNXCnJGTyk', 'QHECYGqyOs', 'ar6CPcoWNM', 'zHYCc0nWBF', 'LKaCKwrj56', 'oIkPU9ZU0L', 'hESP9O2J0K', 'arbPkqvrC7', 'dg8Pdx294o', 'c9PPDwQO1B'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, gyjADuLXfq0PeFsWs3.cs	High entropy of concatenated method names: 'qXa57AUKsP', 'X8b5SX3S8P', 'D4e5Qui8rs', 'qal5LYEuXZ', 'YZS5IM8QUF', 'coY5yLO0Ck', 'Dji5sJRCEC', 'Swn5gU3Y1B', 'mSx5bjF3qG', 'tuT5ioAkbN'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, tkV5WJwR3JlKYuw1Ej.cs	High entropy of concatenated method names: 'i13sxxg6ye', 'UAVs6J3jGf', 'ToString', 'dbasFI3BwU', 'rinsYdeWB0', 'Tf5s5mM5S2', 'MjjsPa6l1u', 'zLosCVjQIU', 'pyBscPQmod', 'YMYsKVQPUq'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, kwsnHd3D9pAL148Rf1.cs	High entropy of concatenated method names: 'Ww7Cr9HDP4', 'JyXCGflTi1', 'o9bCNt1ek6', 'P6vF0u2qBx4QxnA3ypc', 'sBToKX2sXGUnADsyPYF', 'vn1peu2JbdLT0xPgfWw', 'aBU0bj25uZPwellOY9b'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, gytIsVqF8MuD80NBw2.cs	High entropy of concatenated method names: 'ToString', 'B3ZypCGBEI', 'UR8yV8hA2f', 's8dyuu4h7x', 'Y0ZyeegDkT', 'KViy3klWnG', 'qrayNtstaX', 'C78yr3tCcQ', 'N3TymAgHAG', 'lQiyGZ8aVf'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, tEdNnMhdKHTbHQJoVm.cs	High entropy of concatenated method names: 'Gq7IT2NZHb', 'ltmIW0mRqy', 'DBoIhoCgwh', 'pE0Ij51JqK', 'mNpIV7k43K', 'Q4NIuFl2o8', 'Y37IeN6Ojp', 'rtRI3rsCam', 'H2xINubJte', 'uVFIrTSUCR'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, X8yytkHu8Bt1Puv27C.cs	High entropy of concatenated method names: 'b3rthX3x6', 'XvD71dNM5', 'nsrSV6jgQ', 'ckmvFVKmh', 'KNXL7DoN3', 'SNFXRtKA9', 'm1UPrMjudABTcAeQdC', 'ROeEnGwqnr0vnvXW64', 'oL6gqcnLb', 'Jd5ir5J6E'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, lYEfDODVqWlx3E11Q7.cs	High entropy of concatenated method names: 'LmrbZAovvH', 'SAdbVbiVyL', 'Ac2busbPge', 'AQCbe6rNkP', 'rN6b3pBW4s', 'Xp1bNK4Qlj', 'NtBbrupSXv', 'Oirbm8EG1p', 'FMMbG2N9R5', 'M9dbTB7Guj'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, oeCGxP9hPhHPGyyRta.cs	High entropy of concatenated method names: 'gSSsdqGo6G', 'TBwso4h8y4', 'zoog03AtDp', 'eM4g1nnf9E', 'D6RspcoAxE', 'r18sWR0yaW', 'AZ7sOJUllt', 'FDcshYvoM7', 'PMUsjKT1fg', 'w0qsqMSvAD'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, l7uwjVkLYhaEET5eZg.cs	High entropy of concatenated method names: 'NOPbISmEgt', 'SqEbsaGFuc', 'ydEbbUTwDy', 'yQnbA06cqO', 'weVbMNqY8Z', 'dheb4Dn24b', 'Dispose', 'xprgFKONB6', 'D2hgYS5HIO', 'ePwg5uZIof'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, YHIc1t1agveHGox9DlV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FeJ8bLFk34', 'jBp8iI1EXi', 'TLF8AYB7lO', 'MvX88XLL9T', 'uYE8MjLSpx', 'GUK8l9Oiuc', 'KFa84hWtwZ'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, o8MKfyrc7cYmq4eBVV.cs	High entropy of concatenated method names: 'h3qcFprRJn', 'K88c5beY6q', 'UK3cCfNcyZ', 'YQeCoeDoyO', 'KlZCzgpIw6', 'lW4c05FZuf', 'nNhc1DSxVO', 'NiXcHQX0ae', 'ps3cf7Eoys', 'Qywcaj27OC'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, lrQBfVV0rfHwgJoiLc.cs	High entropy of concatenated method names: 'QxRD9x24HcpebWts3CO', 'zUuf1R2QGuCeiVxJAeX', 'oI2vLD2N9ki0sTnF8PY', 'MgGCgSkenW', 'XO1CbdnCJC', 'Fq7Ci4HLLp', 'G1Ziwk2oXKuyB5fhbHT', 'Vh3KG12FCYQHR4jRI22'
Source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, gT1bvP5O25dwYsGRwM.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'nw9HDdlXL2', 'wsLHoweiE9', 'p0ZHzaHnLQ', 'qUIf0i2bSK', 'vLff1k8hbP', 'q3bfHlOdCo', 'llhff7qIuu', 'CjGF87HPXZBAxrLWIub'

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00406128 ShellExecuteW,URLDownloadToFileW,

5_2_00406128

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

File created: C:\Users\user\AppData\Roaming\Graias\graias.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-O844B9

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00419BD4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_00419BD4

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-O844B9			Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-O844B9			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

5_2_0041BCF3

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dxdiag.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dxdiag.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dxdiag.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: graias.exe PID: 6620, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0040E54F Sleep,ExitProcess,

5_2_0040E54F

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\dxdiag.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} WHERE ResultClass = Win32_DiskDrive
Source: C:\Windows\SysWOW64\dxdiag.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk Where DriveType=3

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\dxdiag.exe

System information queried: FirmwareTableInformation

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: 9680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: A680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: A890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory allocated: B890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: 8BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: 9BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: 9DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory allocated: ADD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Code function: 38_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,

38_2_0040DD85

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

5_2_004198D2

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5563	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 408	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6046	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1579	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Window / User API: threadDelayed 8756

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Evaded block: after key decision	graph_5-47121
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Evaded block: after key decision	graph_5-47097
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Evaded block: after key decision	graph_5-47101

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	API coverage: 5.8 %
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	API coverage: 9.5 %

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe TID: 7040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6408	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7116	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe TID: 4304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 6046 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7316	Thread sleep count: 1579 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe TID: 7236	Thread sleep time: -26268000s >= -30000s

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\SysWOW64\dxdiag.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0040B335
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0041B43F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	5_2_0041B43F
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0040B53A
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	5_2_004089A9
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00406AC2 FindFirstFileW,FindNextFileW,	5_2_00406AC2
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	5_2_00407A8C
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00418C79 FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_00418C79
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	5_2_00408DA7
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_100010F1
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 38_2_0040AE51 FindFirstFileW,FindNextFileW,	38_2_0040AE51
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 39_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	39_2_00407EF8
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 41_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	41_2_00407898

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_00406F06

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Code function: 38_2_00418981 memset,GetSystemInfo,

38_2_00418981

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: svchost.exe, 0000002C.00000002.2207078230.0000000002A3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: graias.exe, 00000006.00000002.1731190562.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000016.00000002.1908700310.000000000323F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:s
Source: graias.exe, 00000006.00000002.1731190562.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\C#
Source: graias.exe, 00000008.00000002.2395821295.00000000011E7000.00000004.00000020.00020000.00000000.sdmp, graias.exe, 00000008.00000002.2395821295.000000000125A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000038.00000002.2367956151.000000000343F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000033.00000002.2284798507.000000000343F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d\\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: graias.exe, 00000006.00000002.1731190562.0000000006BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0043A66D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_0043A66D

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

38_2_0040DD85

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

5_2_0041BCF3

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00442564 mov eax, dword ptr fs:[00000030h]		5_2_00442564
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10004AB4 mov eax, dword ptr fs:[00000030h]		8_2_10004AB4

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0044E93E GetProcessHeap,

5_2_0044E93E

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00434178 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00434178
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_0043A66D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0043A66D
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00433B54 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00433B54
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: 5_2_00433CE7 SetUnhandledExceptionFilter,	5_2_00433CE7
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_100060E2
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_10002639
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: 8_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_10002B1C

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Memory written: C:\Users\user\Desktop\iGhDjzEiDU.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Users\user\AppData\Roaming\Graias\graias.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Users\user\AppData\Roaming\Graias\graias.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Users\user\AppData\Roaming\Graias\graias.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Users\user\AppData\Roaming\Graias\graias.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2818008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 26D6008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2DBB008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 257D008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 24A2008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 25E3008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2E36008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2E89008
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 266A008

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

5_2_00410F36

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00418764 mouse_event,

5_2_00418764

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\Desktop\iGhDjzEiDU.exe "C:\Users\user\Desktop\iGhDjzEiDU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe "C:\Users\user\AppData\Roaming\Graias\graias.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\dxdiag.exe "C:\Windows\System32\dxdiag.exe" /t C:\Users\user\AppData\Local\Temp\sysinfo.txt
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\orbocvcopxyxxqzovbukeapdendakrxtoq"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Users\user\AppData\Roaming\Graias\graias.exe C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0

Source: logs.dat.8.dr	Binary or memory string: [2025/01/03 18:02:24 Program Manager]
Source: logs.dat.8.dr	Binary or memory string: [2025/01/03 18:03:45 Program Manager]
Source: logs.dat.8.dr	Binary or memory string: [2025/01/03 18:02:45 Program Manager]
Source: graias.exe, 00000008.00000002.2395821295.00000000011E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00433E1A cpuid

5_2_00433E1A

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoW,	5_2_004510CA
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: EnumSystemLocalesW,	5_2_004470BE
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004511F3
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoW,	5_2_004512FA
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004513C7
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoW,	5_2_004475A7
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoA,	5_2_0040E679
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00450A8F
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: EnumSystemLocalesW,	5_2_00450D52
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: EnumSystemLocalesW,	5_2_00450D07
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: EnumSystemLocalesW,	5_2_00450DED
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00450E7A

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Users\user\Desktop\iGhDjzEiDU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\Users\user\AppData\Roaming\Graias\graias.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dxdiag.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\dxdiag.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00434020 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00434020

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_0041A7B2 GetUserNameW,

5_2_0041A7B2

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: 5_2_00448067 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_00448067

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe

Code function: 38_2_0041739B GetVersionExW,

38_2_0041739B

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\graias\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

5_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		5_2_0040B335
Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Code function: \key3.db		5_2_0040B335

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: ESMTPPassword	39_2_004033F0
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword	39_2_00402DB3
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword	39_2_00402DB3

Yara detected WebBrowserPassView password recovery tool

Source: Yara match

File source: Process Memory Space: graias.exe PID: 7468, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-O844B9			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Graias\graias.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-O844B9

Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.iGhDjzEiDU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.43c65b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.4309f98.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iGhDjzEiDU.exe.424d978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iGhDjzEiDU.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\graias\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\iGhDjzEiDU.exe

Code function: cmd.exe

5_2_00405042

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	231 Windows Management Instrumentation	11 Scripting	1 LSASS Driver	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	21 Native API	1 LSASS Driver	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	3 Obfuscated Files or Information	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Windows Service	1 Access Token Manipulation	12 Software Packing	3 Credentials In Files	4 File and Directory Discovery	Distributed Component Object Model	221 Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	1 Windows Service	1 DLL Side-Loading	LSA Secrets	159 System Information Discovery	SSH	3 Clipboard Data	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	322 Process Injection	1 Bypass User Account Control	Cached Domain Credentials	451 Security Software Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	322 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
iGhDjzEiDU.exe	71%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
iGhDjzEiDU.exe	100%	Avira	HEUR/AGEN.1309540
iGhDjzEiDU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Graias\graias.exe	100%	Avira	HEUR/AGEN.1309540
C:\Users\user\AppData\Roaming\Graias\graias.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Graias\graias.exe	71%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Source	Detection	Scanner	Label	Link
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	0%	Avira URL Cloud	safe
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geoplugin.net	178.237.33.50	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.196	true	false	high
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_157.13.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	chpC919.tmp.38.dr	false		high
http://www.fontbureau.com/designersG	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.imvu.comr	graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chpC919.tmp.38.dr	false		high
http://www.fontbureau.com/designers/?	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_157.13.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://www.tiro.com	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chpC919.tmp.38.dr	false		high
http://www.fontbureau.com/designers	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net	graias.exe, 00000026.00000002.2105157332.0000000000D73000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_157.13.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_190.13.dr	false		high
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_157.13.dr	false		high
http://www.sajatypeworks.com	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_157.13.dr	false		high
http://geoplugin.net/json.gp/C	iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, iGhDjzEiDU.exe, 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, iGhDjzEiDU.exe, 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_157.13.dr, chromecache_191.13.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chpC919.tmp.38.dr	false		high
http://www.galapagosdesign.com/DPlease	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://login.yahoo.com/config/login	graias.exe	false		high
http://www.fonts.com	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://github.com/gewarren	chromecache_157.13.dr	false		high
http://www.urwpp.deDPlease	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net/	graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	iGhDjzEiDU.exe, 00000000.00000002.1684799990.0000000003141000.00000004.00000800.00020000.00000000.sdmp, graias.exe, 00000006.00000002.1717497130.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_157.13.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_157.13.dr	false	Avira URL Cloud: safe	unknown
https://client-api.arkoselabs.com/v2/api.js	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	chpC919.tmp.38.dr	false		high
https://github.com/Thraka	chromecache_157.13.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://aka.ms/certhelp	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://www.imvu.com	graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chpC919.tmp.38.dr	false		high
https://github.com/mairaw	chromecache_157.13.dr	false		high
https://schema.org	chromecache_190.13.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://www.ecosia.org/newtab/	chpC919.tmp.38.dr	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_157.13.dr	false		high
http://www.carterandcone.coml	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	chpC919.tmp.38.dr	false		high
https://github.com/nschonni	chromecache_157.13.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://www.fontbureau.com/designers/frere-user.html	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_157.13.dr	false		high
http://www.jiyu-kobo.co.jp/	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://www.fontbureau.com/designers8	iGhDjzEiDU.exe, 00000000.00000002.1708895090.00000000071F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/servicelogin	graias.exe	false		high
https://github.com/js-cookie/js-cookie	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://schema.org/Organization	chromecache_157.13.dr	false		high
https://channel9.msdn.com/	chromecache_169.13.dr, chromecache_190.13.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chpC919.tmp.38.dr	false		high
https://github.com/dotnet/try	chromecache_169.13.dr, chromecache_190.13.dr	false		high
http://www.ebuddy.com	graias.exe, graias.exe, 00000029.00000002.2092881288.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
185.234.72.215	unknown	United Kingdom	30823	COMBAHTONcombahtonGmbHDE	true

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583975
Start date and time:	2025-01-04 00:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iGhDjzEiDU.exe renamed because original name is a hash value
Original Sample Name:	7caf240db905f259197cf71b03acf888.exe
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winEXE@176/88@11/6
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 97% Number of executed functions: 270 Number of non-executed functions: 216
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.14, 142.250.186.99, 142.250.185.174, 74.125.133.84, 95.101.150.2, 142.250.184.238, 142.250.185.142, 199.232.210.172, 20.189.173.18, 216.58.212.138, 142.250.185.170, 172.217.23.106, 142.250.181.234, 142.250.186.170, 142.250.185.138, 172.217.18.106, 142.250.184.202, 142.250.185.106, 142.250.186.138, 216.58.206.42, 142.250.186.74, 142.250.185.202, 142.250.185.234, 216.58.212.170, 172.217.16.138, 192.229.221.95, 2.22.242.139, 2.22.242.82, 13.74.129.1, 13.107.21.237, 204.79.197.237, 13.89.178.26, 142.250.181.238, 216.58.212.174, 172.217.16.142, 142.250.186.78, 142.250.186.131, 34.104.35.123, 142.250.185.238, 172.217.16.206, 2.16.168.102, 2.16.168.100, 20.189.173.25, 142.250.185.110, 23.56.254.164, 13.107.246.45, 20.12.23.50, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, otelrules.afd.azureedge.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdcus00.centralus.cloudapp.azure.com, onedscolprdwus15.westus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go
Execution Graph export aborted for target dxdiag.exe, PID 8544 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: iGhDjzEiDU.exe

Simulations

Behavior and APIs

Time	Type	Description
18:01:56	API Interceptor	1x Sleep call for process: iGhDjzEiDU.exe modified
18:01:58	API Interceptor	38x Sleep call for process: powershell.exe modified
18:01:59	API Interceptor	9066x Sleep call for process: graias.exe modified
23:02:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-O844B9 "C:\Users\user\AppData\Roaming\Graias\graias.exe"
23:02:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-O844B9 "C:\Users\user\AppData\Roaming\Graias\graias.exe"

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	random.exe	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Unknown	Browse
	1735939565593f5d6bf694464eb338b020a826ec212acacc46d4424bb914edbae3d507116e469.dat-decoded.exe	Get hash	malicious	LiteHTTP Bot	Browse
	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==	Get hash	malicious	Unknown	Browse
	https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832	Get hash	malicious	KnowBe4	Browse
	https://www.copiat.ro/6.exe	Get hash	malicious	Unknown	Browse
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	http://lzkaw.theaudiobee.com/4JvVHv3166gBJC324kvamxlnkfn259BVCQSWLGBOGFXUP772APMZ15384h17	Get hash	malicious	Unknown	Browse
	https://rfqdocu.construction-org.com/Q5kL4/	Get hash	malicious	HTMLPhisher	Browse
	https://www.earthsatellitemaps.co/esmrel/landing.php?uid=0&lid=0&sid=531485973&sid2=1361197931118060&sid3=&sid4=google%20maps%20pro&sid5=&sid6=&sid7=&sid8=&rid=&_agid=0&aid=0&r=657&_agid=73407&msclkid=8b3e7b2e92fe1f072cfc1c5c7ae3c44d	Get hash	malicious	Unknown	Browse
13.107.246.67	http://knoxoms.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
178.237.33.50	1.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1evAkYZpwDV0N4v.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	94e.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	94e.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	0442.pdf.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1734707047fff7a4a195c1e77157873964de3a3a708aa4bdc0aee24f3a94bc5bd05cc323f3964.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	random.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	13.107.246.45
	1735939565593f5d6bf694464eb338b020a826ec212acacc46d4424bb914edbae3d507116e469.dat-decoded.exe	Get hash	malicious	LiteHTTP Bot	Browse	13.107.246.45
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	13.107.246.45
	https://rfqdocu.construction-org.com/Q5kL4/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://www.earthsatellitemaps.co/esmrel/landing.php?uid=0&lid=0&sid=531485973&sid2=1361197931118060&sid3=&sid4=google%20maps%20pro&sid5=&sid6=&sid7=&sid8=&rid=&_agid=0&aid=0&r=657&_agid=73407&msclkid=8b3e7b2e92fe1f072cfc1c5c7ae3c44d	Get hash	malicious	Unknown	Browse	13.107.246.45
	Automatisation Microsoft 365.msg	Get hash	malicious	unknown	Browse	13.107.246.45
	http://www.klim.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	Reparto Trabajo TP4.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
s-part-0039.t-0009.t-msedge.net	http://knoxoms.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
geoplugin.net	1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1evAkYZpwDV0N4v.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	94e.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	94e.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0442.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1734707047fff7a4a195c1e77157873964de3a3a708aa4bdc0aee24f3a94bc5bd05cc323f3964.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	4.elf	Get hash	malicious	Unknown	Browse	157.55.8.211
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	20.85.193.111
	random.exe	Get hash	malicious	Unknown	Browse	104.46.162.224
	random.exe	Get hash	malicious	Unknown	Browse	20.52.64.201
	2.elf	Get hash	malicious	Unknown	Browse	51.122.34.90
	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==	Get hash	malicious	Unknown	Browse	13.107.42.14
	3.elf	Get hash	malicious	Unknown	Browse	51.142.50.179
	armv6l.elf	Get hash	malicious	Mirai	Browse	20.40.176.182
	1.elf	Get hash	malicious	Unknown	Browse	157.56.241.207
	armv5l.elf	Get hash	malicious	Mirai	Browse	20.75.71.78
COMBAHTONcombahtonGmbHDE	b1593574e46fb1f30b1da4fa594f43bb52b051a616db3.exe	Get hash	malicious	XenoRAT	Browse	194.59.30.69
	Syncing.exe	Get hash	malicious	AsyncRAT	Browse	185.223.30.86
	l4.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	l4.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Support.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.27
ATOM86-ASATOM86NL	1.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Faxed_6761fa19c0f9d_293874738_EXPORT_SOA__REF2632737463773364_221PLW.exe.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1evAkYZpwDV0N4v.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	94e.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	94e.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0442.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1734707047fff7a4a195c1e77157873964de3a3a708aa4bdc0aee24f3a94bc5bd05cc323f3964.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	data
Category:	dropped
Size (bytes):	8476
Entropy (8bit):	3.5602841485909233
Encrypted:	false
SSDEEP:	96:xgy4eOnLq4TXjLq48OLq4dCImLq433CLq4ILq4g4Lq4mFBLq4neLq4NMLq4EMLqr:MuCuCuRu/uVuAuHuTuzuYubu6u4
MD5:	2692EF8BCE89A06E76A4C47FD28EBFA1
SHA1:	0859D5695DB371BE69163BFD4BEA124365E5ADD9
SHA-256:	3299D7091D38906B07B21844F0D68AF619A1970A8ED5E04A479C26B7BAA396C3
SHA-512:	165236A479962FA1D4FC740BECB306C564FBA2B814B55DA665DCCFCD9F25EDE2C34F1202D951F96C4AAF85ACB8EF6998BE7C77591DB6A4E9EB6A93F014E5A93B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\graias\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.0. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].....[.W.i.n.].r.....[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.1. .R.u.n.].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.2. .s.v.c.h.o.s.t...e.x.e. .-. .T.h.i.s. .a.p.p.l.i.c.a.t.i.o.n. .c.o.u.l.d. .n.o.t. .b.e. .s.t.a.r.t.e.d...].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.3. .R.u.n.].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.4. .s.v.c.h.o.s.t...e.x.e. .-. .T.h.i.s. .a.p.p.l.i.c.a.t.i.o.n. .c.o.u.l.d. .n.o.t. .b.e. .s.t.a.r.t.e.d...].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.5. .U.n.t.i.t.l.e.d. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.8. .s.v.c.h.o.s.t...e.x.e. .-. .T.h.i.s. .a.p.p.l.i.c.a.t.i.o.n. .c.o.u.l.d. .n.o.t. .b.e. .s.t.a.r.t.e.d...].....[.W.i.n.].r.....[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.0.9. .R.u.n.].........[.2.0.2.5./.0.1./.0.3. .1.8.:.0.2.:.1.0. .U.n.t.i.t.l.e.d. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.2.0.2.5./.0.1./.0.3. .1.8.

C:\Users\user\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Process:	C:\Windows\SysWOW64\dxdiag.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.01237149505889543
Encrypted:	false
SSDEEP:	3:N+/lGlll/l/lXp9ZjrPBY06llcllXwiEl/lRP:m0dPBY0O6/giEXJ
MD5:	27754E2DB48BC95315A62B86FD981E5A
SHA1:	1568ECDB144BE9F8DBC488BC4944D89E31058EA5
SHA-256:	84560889FB3E1F4E9F6302D1A73D62C85E0F7544DCC1255328B8643A0BFCCA09
SHA-512:	FC8BF7FE7489942015F32F2D93DE1B3F3A07E08AAEBC872E89E5C9C20A21449D9BB7E4576695C6C81411BDABD9A96F658F6CD4A1CC502D7045B9DB8568C422F1
Malicious:	false
Preview:	..uA........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Process:	C:\Windows\SysWOW64\dxdiag.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:R:R
MD5:	F49655F856ACB8884CC0ACE29216F511
SHA1:	CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
SHA-256:	7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
SHA-512:	599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
Malicious:	false
Preview:	EERF

C:\Users\user\AppData\Local\D3DSCache\c6e1bc7b336e2cfe\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Process:	C:\Windows\SysWOW64\dxdiag.exe
File Type:	Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.020296169267305913
Encrypted:	false
SSDEEP:	3:9llpl5d2DJqojBdl+Sli5l2GkNl0lR9TNlktt/llaia9sVQMm4qNw:c9q0Bn+SkyGkNlUetb2Hsqi
MD5:	AE2B45690B7A2B278AD387D9AB374E16
SHA1:	1822D3444AF5A00E882B9D1483CCE518FF57FD09
SHA-256:	F617DFE9D4C2FE77DC462523FF803A1C7D9E23E014D63F64D2202DFC519BFEE7
SHA-512:	36D490650F9FB4280A83B9869F54C8C4B2AA317652397726107B44AF344E377118A6306DE71BC2D4DE012CDDD8E8A7C157F6164D619F315D264841E36137A01D
Malicious:	false
Preview:	................>...(....x:no.&A.e.u~+..C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.d.x.d.i.a.g...e.x.e.................................(...p.DJ!.IL.....Z.F.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\graias.exe.log

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\iGhDjzEiDU.exe.log

Process:	C:\Users\user\Desktop\iGhDjzEiDU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.019205124979377
Encrypted:	false
SSDEEP:	12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlupdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	B62617530A8532F9AECAA939B6AB93BB
SHA1:	E4DE9E9838052597EB2A5B363654C737BA1E6A66
SHA-256:	508F952EF83C41861ECD44FB821F7BB73535BFF89F54D54C3549127DCA004E70
SHA-512:	A0B385593B721313130CF14182F3B6EE5FF29D2A36FED99139FA2EE838002DFEEC83285DEDEAE437A53D053FCC631AEAD001D3E804386211BBA2F174134EA70D
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZSUyus:fLHyIFKL3IZ2KRH9OugEs
MD5:	C0097F75360CA66B65DB5A4E62501B4D
SHA1:	B6EE5A4442E2C932AF07B472D8F4EB5DC1F2EBD3
SHA-256:	18E34BD63BEFE61C852C04D8C9294201F91B905D50D3BBFC7411FD598FF8F8AE
SHA-512:	64BF0392903A9CF79BF54B82C1CB5E8C8323D746125AA64575D2BB9B4343F55FE9DF6D347B8BE0F43ED1470DBA9E46B46F7D6BCEF6047E565544529DBA517693
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04b42xsn.hyj.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vt5cwvv.0r2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gz3u5ilo.z0o.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_md5bsqcp.aso.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogwhplav.jo4.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qvp41p30.fed.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uqgfxdzx.ftz.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wppcnxt1.5go.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhvC4F2.tmp

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chpC919.tmp

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chpC949.tmp

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\sysinfo.txt

Process:	C:\Windows\SysWOW64\dxdiag.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	83964
Entropy (8bit):	5.188571918391598
Encrypted:	false
SSDEEP:	768:QP9UpyBAyBjl6UhPJgG6ofJvV7lV6EMR5uX3l0hG6NUVPkNEr+aL/FkJOlKwY0:QD3VP6muR2gUeOu0
MD5:	C07F7DE7E42D289AF493F73A6E8B10ED
SHA1:	545FA4175045C0960E750D1E03E5330CFEBF78B5
SHA-256:	76667BFCFC739EB9FC89837608EB0BE4A11E995E181A245840230E829F49529A
SHA-512:	A8D049FF6AF1CB1E8F942106E41976DD28C48BE96220D50E03F7DA3F6E260B8E0E83C042EE8822FF3B232BC58E6BCFE84A46302CE4BDFD59D2A3C769B3ECA49E
Malicious:	false
Preview:	------------------..System Information..------------------.. Time of this report: 1/3/2025, 18:02:34.. Machine name: 783875.. Machine Id: Unknown.. Operating System: Windows 10 Pro 64-bit (10.0, Build 19045) (19041.vb_release.191206-1406).. Language: English (Regional Setting: English).. System Manufacturer: FwOzYOUKbAaU2RD.. System Model: eSZX 9p9.. BIOS: VMW201.00V.20829224.B64.2211211842 (type: UEFI).. Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 CPUs), ~2.0GHz.. Memory: 8192MB RAM.. Available OS Memory: 8192MB RAM.. Page File: 2467MB used, 5723MB available.. Windows Dir: C:\Windows.. DirectX Version: DirectX 12.. DX Setup Parameters: Not found.. User DPI Setting: 96 DPI (100 percent).. System DPI Setting: 96 DPI (100 percent).. DWM DPI Scaling: Disabled.. Miracast: N

C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs

Process:	C:\Users\user\AppData\Roaming\Graias\graias.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	3.435185090535513
Encrypted:	false
SSDEEP:	12:xQ4lA2++ugypjBQMPURbRKMJV62Q3DoRKMJV629HPoRKMJVo/0aimi:7a2+SDdrr62QTorr629vorrhait
MD5:	771DE7523AB6947394C64CFD5BBB3B99
SHA1:	CCD78BE7B23A93DF03CCC675B4E1A60EEB13B276
SHA-256:	25AD41ACE65051280FE9743DB008A160CA8442069BE38224CE862094EEDC314B
SHA-512:	CB13EC679DA933FEF28079EDA4EECA5DD029B6556D5F9C9C8E34E3EE7224C2682F0B817B667A7FDA9D04B612A01A4D7767CEB0CF2687111E162E24F61472890B
Malicious:	true
Preview:	O.n. .E.r.r.o.r. .R.e.s.u.m.e. .N.e.x.t...S.e.t. .f.s.o. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".S.c.r.i.p.t.i.n.g...F.i.l.e.S.y.s.t.e.m.O.b.j.e.c.t.".)...w.h.i.l.e. .f.s.o...F.i.l.e.E.x.i.s.t.s.(.".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.r.a.i.a.s.\.g.r.a.i.a.s...e.x.e.".)...f.s.o...D.e.l.e.t.e.F.i.l.e. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.r.a.i.a.s.\.g.r.a.i.a.s...e.x.e."...w.e.n.d...f.s.o...D.e.l.e.t.e.F.o.l.d.e.r. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.r.a.i.a.s."...f.s.o...D.e.l.e.t.e.F.i.l.e.(.W.s.c.r.i.p.t...S.c.r.i.p.t.F.u.l.l.N.a.m.e.).

C:\Users\user\AppData\Roaming\Graias\graias.exe

Process:	C:\Users\user\Desktop\iGhDjzEiDU.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	983040
Entropy (8bit):	7.849370824950313
Encrypted:	false
SSDEEP:	24576:GzrpUdcKiEWIXZ4aQJkf1dedJNxkTeGnAoEe:cpKiEWIJ4aWkfjedxkTeGAo9
MD5:	7CAF240DB905F259197CF71B03ACF888
SHA1:	D8D9726A0A67795A01FED368055D9315FEADA3FD
SHA-256:	C8017F526793DD8B6B6E98BFA9847FCF3AA7C4096A8432719A8324E06BA8C088
SHA-512:	1F9464E14D33BFAB44DFC85486BEA31126A26929E04EAE1159E6ECC886AA79877CA29AA93E614512625000D153E090C06B3B2081F9CBC1E8997AD26E59097255
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Qrg..............0......4........... ........@.. .......................`............`.................................t...O........1...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc....1.......2..................@..@.reloc.......@......................@..B........................H........D..T0..........<u..8s...........................................0............}......}......}.....(.......(......{.....r...pr...p~9...%-.&~8.........s....%.9...(...+(...+~:...%-.&~8...../...s....%.:...(...+...5...%..(...+s.....%.r...p.%.r#..p...6...(....r5..p ............%...%...(......{....o....&*..0..H.........{....o ...r...po!.....,..rS..p("...&.{....o....&8.....{....o ...r...po!.....,..r{..p("...&.{....o....&8.....{....o#........,....{.....X}.....+....}.....s.....

C:\Users\user\AppData\Roaming\Graias\graias.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\iGhDjzEiDU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Chrome Cache Entry: 151

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 152

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 153

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 154

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 157

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 158

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 159

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 160

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 162

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 163

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 164

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 165

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 166

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 167

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 168

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 169

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 170

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 171

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 172

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 173

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 174

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 175

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 176

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 177

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 178

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 179

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 180

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 181

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 182

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 183

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 184

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 186

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 187

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 188

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 189

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 190

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 191

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 192

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.849370824950313
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	iGhDjzEiDU.exe
File size:	983'040 bytes
MD5:	7caf240db905f259197cf71b03acf888
SHA1:	d8d9726a0a67795a01fed368055d9315feada3fd
SHA256:	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088
SHA512:	1f9464e14d33bfab44dfc85486bea31126a26929e04eae1159e6ecc886aa79877ca29aa93e614512625000d153e090c06b3b2081f9cbc1e8997ad26e59097255
SSDEEP:	24576:GzrpUdcKiEWIXZ4aQJkf1dedJNxkTeGnAoEe:cpKiEWIJ4aWkfjedxkTeGAo9
TLSH:	1E2512586B0AE103C95527B40E71F2B51A7D5DDEA911E3378FEC3EEBB826E106D44183
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Qrg..............0......4........... ........@.. .......................`............`................................

File Icon


Icon Hash:	16bb2d4d6ccc6593

Static PE Info

General

Entrypoint:	0x4ee8c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677251C7 [Mon Dec 30 07:54:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xee874	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x3190	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xec8cc	0xeca00	7f12c90f661e0fa256f09b40324836b5	False	0.9459707639989435	data	7.85185407933489	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x3190	0x3200	28abd9e935f7422da319fe74aa8ab824	False	0.94203125	data	7.778196284666235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	fce2046bacbe188f7635dba22cdfe257	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf00c8	0x2d81	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9937333676710447
RT_GROUP_ICON	0xf2e5c	0x14	data	1.05
RT_VERSION	0xf2e80	0x30c	data	0.43205128205128207

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T00:02:01.636826+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49733	185.234.72.215	4444	TCP
2025-01-04T00:02:02.270456+0100	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	185.234.72.215	4444	192.168.2.4	49733	TCP
2025-01-04T00:02:03.166741+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 00:01:50.824821949 CET	49675	443	192.168.2.4	173.222.162.32
Jan 4, 2025 00:02:00.449810982 CET	49675	443	192.168.2.4	173.222.162.32
Jan 4, 2025 00:02:01.630750895 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:01.635687113 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:01.635767937 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:01.636826038 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:01.641697884 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:02.270456076 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:02.290539026 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:02.295475960 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:02.410545111 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:02.540384054 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:02:02.545201063 CET	80	49735	178.237.33.50	192.168.2.4
Jan 4, 2025 00:02:02.545485020 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:02:02.551342964 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:02:02.565057993 CET	80	49735	178.237.33.50	192.168.2.4
Jan 4, 2025 00:02:02.621609926 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:02.621807098 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:03.166555882 CET	80	49735	178.237.33.50	192.168.2.4
Jan 4, 2025 00:02:03.166740894 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:02:03.240492105 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:03.245316982 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.045298100 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.048532963 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.053467989 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.053540945 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.053613901 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.058356047 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.152940989 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.161755085 CET	80	49735	178.237.33.50	192.168.2.4
Jan 4, 2025 00:02:04.161813021 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:02:04.176393986 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.192348957 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.197191954 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.197271109 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.197899103 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.202729940 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.256293058 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.261190891 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261202097 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261219978 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261229038 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261254072 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.261286974 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.261291027 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261298895 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261324883 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261333942 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261356115 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:04.261357069 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.261409044 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.266108036 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.266115904 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.266170979 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.266180038 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.266216993 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.309551001 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:04.340447903 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:05.063615084 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:05.068447113 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.263169050 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.348860979 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:05.354118109 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:05.360749006 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360759974 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360769987 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360780001 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360846996 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360857010 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360865116 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.360874891 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.361020088 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.365748882 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.365762949 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367264986 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367417097 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367427111 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367438078 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367559910 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367572069 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367575884 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367579937 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:05.367695093 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.200436115 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:06.205271006 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.381927013 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.437561035 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:06.514251947 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:06.519144058 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519155025 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519172907 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519181013 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519265890 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519274950 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519320011 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519329071 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519346952 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.519452095 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.523911953 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.523920059 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.523961067 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.523968935 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.524089098 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.524108887 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.524224043 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.524233103 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:06.524235964 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.201760054 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:07.206598043 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.382988930 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.446836948 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:07.453722954 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453792095 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453912973 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453921080 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453928947 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453964949 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453974009 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.453984976 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.454013109 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.454061985 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459398031 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459408045 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459440947 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459450006 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459500074 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459513903 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459602118 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459611893 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:07.459619999 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.220990896 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:08.226299047 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.403731108 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.486733913 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:08.491703033 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491718054 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491749048 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491754055 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491820097 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491826057 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491841078 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491872072 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491926908 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491931915 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491976023 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491981983 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.491996050 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492038012 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492098093 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492104053 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492162943 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492168903 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492187023 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492192984 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:08.492211103 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.266594887 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:09.271372080 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.447871923 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.501133919 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:09.549489975 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:09.554291010 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554414034 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554431915 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554442883 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554533005 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554543972 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554553986 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554658890 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554670095 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.554677963 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559034109 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559051991 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559158087 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559166908 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559212923 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559228897 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559283018 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559308052 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559365034 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559374094 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.559426069 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:09.783204079 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:09.783236980 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:09.783334017 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:09.783464909 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:09.783482075 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.317853928 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:10.322654963 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.421518087 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.422768116 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.422789097 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.423917055 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.424078941 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.426026106 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.426099062 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.426685095 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.426692009 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.499066114 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.530539036 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.530564070 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.530651093 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.530668020 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.530678988 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.530728102 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.551039934 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:10.613531113 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.613547087 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.613581896 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.613593102 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.613641024 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.613656998 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.613687992 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.615432978 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.615458012 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.615490913 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.615500927 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.615509987 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.615534067 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.615550041 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.628951073 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:10.633843899 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.633856058 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.633874893 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.633883953 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.633989096 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.633999109 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634118080 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634124041 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634130001 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634130955 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634159088 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634169102 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634311914 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634321928 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634330034 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634340048 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634358883 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634372950 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634417057 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634427071 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.634438038 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:10.669594049 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:10.669626951 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:10.669691086 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:10.669972897 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:10.669991016 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:10.699794054 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.699817896 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.699887037 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.699918032 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.699954033 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.701158047 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.701183081 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.701287031 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.701292992 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.701318979 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.702518940 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.702533007 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.702579975 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.702586889 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.702718019 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.704055071 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.704077005 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.704121113 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.704127073 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.704160929 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.748243093 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.786762953 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.786787033 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.786830902 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.786838055 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.786859989 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.786880016 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.787920952 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.787940025 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.788003922 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.788009882 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.788042068 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.788054943 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.789520025 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.789535046 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.789597034 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.789602041 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.789654016 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.790472984 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.790496111 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.790540934 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.790544987 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.790574074 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.790594101 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.792105913 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.792124987 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.792170048 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.792175055 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.792205095 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.792216063 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.792974949 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.793023109 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.793037891 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.793040037 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:10.793085098 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.796068907 CET	49751	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:10.796073914 CET	443	49751	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:11.321285009 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:11.321561098 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:11.321599007 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:11.322654009 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:11.322715044 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:11.324006081 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:11.324083090 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:11.332740068 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:11.337677002 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.388828993 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:11.388842106 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:11.514281988 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.538743973 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:11.565742016 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:11.578704119 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:11.583568096 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583610058 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583630085 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583638906 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583722115 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583731890 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583743095 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583806992 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583817005 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583832979 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583853960 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583863020 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583900928 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583909988 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583950043 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583960056 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583971977 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.583981037 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.584052086 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.584062099 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:11.584070921 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:12.340379953 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:12.345154047 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:12.389957905 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:12.390053034 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:12.390110016 CET	49738	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:12.391720057 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:12.391798973 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:12.394927979 CET	4444	49738	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:13.367717981 CET	49737	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:13.372473955 CET	4444	49737	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:18.897994995 CET	49723	80	192.168.2.4	199.232.214.172
Jan 4, 2025 00:02:18.902947903 CET	80	49723	199.232.214.172	192.168.2.4
Jan 4, 2025 00:02:18.903145075 CET	49723	80	192.168.2.4	199.232.214.172
Jan 4, 2025 00:02:20.769398928 CET	49672	443	192.168.2.4	173.222.162.32
Jan 4, 2025 00:02:20.769431114 CET	443	49672	173.222.162.32	192.168.2.4
Jan 4, 2025 00:02:21.256869078 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:21.257035017 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:21.257102966 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:21.270993948 CET	49755	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:02:21.271015882 CET	443	49755	142.250.185.196	192.168.2.4
Jan 4, 2025 00:02:22.297538042 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:22.297579050 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:22.297954082 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:22.298608065 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:22.298628092 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:22.937283039 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:23.019634962 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:23.019646883 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:23.020066977 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:23.046168089 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:23.046256065 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:23.262782097 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:23.738641977 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:23.749861002 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:23.754689932 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:27.684670925 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:27.684762001 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:27.684860945 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:27.693675041 CET	49855	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:27.693685055 CET	443	49855	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:29.474571943 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:29.474647045 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:29.474814892 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:29.475205898 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:29.475219011 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:30.160161018 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:30.160417080 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:30.160442114 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:30.160908937 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:30.161375046 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:30.161529064 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:30.237202883 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:34.122637987 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.256378889 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.256433964 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.295774937 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.297445059 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.300637007 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.300713062 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.300769091 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.302304983 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.302366018 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.302475929 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.305533886 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.307246923 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.361651897 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366563082 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366580963 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366599083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366607904 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366620064 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366641998 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366653919 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366663933 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366667986 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366703987 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366705894 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366715908 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366722107 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366750956 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366765022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366775990 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.366779089 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.366810083 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.371438026 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.371450901 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.371462107 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.371546030 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.371555090 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.417504072 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.490128994 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.612435102 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.630032063 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.633312941 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.638086081 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.638256073 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.638297081 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.643071890 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:34.747230053 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:34.880851030 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:34.880925894 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:34.881016970 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:35.094979048 CET	49890	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:35.095000982 CET	443	49890	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:35.310899973 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:35.315768957 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.519896984 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.584270954 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:35.589190006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589198112 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589256048 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589260101 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589301109 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589304924 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589354038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589370966 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589412928 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589416981 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589452982 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589481115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589539051 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589550972 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589597940 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589601994 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589612961 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589679956 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589737892 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589741945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589777946 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589782000 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.589822054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:35.663758993 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:35.669619083 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.435337067 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:36.440182924 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.613593102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.745461941 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:36.826900005 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:36.831840992 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.831851006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.831888914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.831897974 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.831943035 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.831950903 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832034111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832042933 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832068920 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832112074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832161903 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832195997 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832304955 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832314014 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832323074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832333088 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832442999 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832452059 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832459927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832467079 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:36.832477093 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:37.089745045 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:37.094708920 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:37.487481117 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:37.492348909 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:37.665357113 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:37.745218039 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.003401041 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.008514881 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008527994 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008544922 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008553982 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008605003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008622885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008704901 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008714914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008781910 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008790016 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008929968 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008938074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008960009 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.008968115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009016037 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009023905 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009087086 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009109020 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009167910 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009176970 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.009185076 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.126076937 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.130923033 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.538377047 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.543200016 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.715924978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.799146891 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.840502977 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.843265057 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.845638990 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.848154068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848164082 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848210096 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848218918 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848294973 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848304033 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848356962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848366022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848376036 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848424911 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848440886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848449945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848469973 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.848478079 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849728107 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849735975 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849781990 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849791050 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849823952 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849832058 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849868059 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849877119 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.849904060 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852855921 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852865934 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852938890 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852947950 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852962017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.852976084 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.853068113 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.853091955 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:38.857875109 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:38.949111938 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.236864090 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.241630077 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.478995085 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479026079 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479037046 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479118109 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.479141951 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479151964 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479190111 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.479201078 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479211092 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479221106 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479262114 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.479262114 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.479310989 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479326963 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.479672909 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.483952045 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.483964920 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.483977079 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.484013081 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.574191093 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574208975 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574249983 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.574260950 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574287891 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574299097 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574328899 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.574383974 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.574666977 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574707031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574718952 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574800968 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.574846029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574860096 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.574929953 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.575485945 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.575526953 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.575534105 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.575544119 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.575614929 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.575623035 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.575633049 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.575695038 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.576404095 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.576414108 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.576423883 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.576472044 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.576534033 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.576545000 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.576585054 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.579087019 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.579097033 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.579108000 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.579140902 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.579149008 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.579159975 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.579178095 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.579209089 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.586524963 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.591348886 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.663115025 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665401936 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665455103 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665465117 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665492058 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665512085 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.665539980 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.665556908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665570021 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665605068 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.665662050 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665672064 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665683031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665709019 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.665749073 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.665874004 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665951014 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665961981 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.665987015 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666017056 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666027069 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666080952 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666239023 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666254044 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666265011 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666285038 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666318893 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666419983 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666429996 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666440010 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666450024 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666495085 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666495085 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666579008 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666589975 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666634083 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.666641951 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666651964 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666661978 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.666682959 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667058945 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667124033 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667136908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667146921 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667185068 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667329073 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667337894 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667349100 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667359114 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667368889 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667375088 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667412043 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667424917 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667469025 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667721033 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667737007 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667747021 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667845964 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.667936087 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667946100 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667956114 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667965889 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.667978048 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.668015003 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.754695892 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754734039 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754745960 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754767895 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754798889 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.754832029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754842997 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754894972 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.754928112 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.754945993 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755001068 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755022049 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755067110 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755086899 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755096912 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755135059 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755146980 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755285978 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755332947 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755350113 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755359888 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755410910 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755426884 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755436897 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755532026 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755594969 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755641937 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755652905 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755743980 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755775928 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755785942 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755796909 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755820036 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.755841017 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.755855083 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756074905 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756123066 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756133080 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756165028 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756186008 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756237030 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756247997 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756257057 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756284952 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756458998 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756469011 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756479025 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756489038 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756498098 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756510019 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.756519079 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756593943 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.756607056 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757074118 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757085085 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757096052 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757143021 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757143021 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757174969 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757184982 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757194996 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757205009 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757230997 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757230997 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757381916 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757390976 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757400990 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757436037 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757456064 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.757533073 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757543087 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757553101 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.757581949 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758050919 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758061886 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758071899 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758101940 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758131981 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758136988 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758146048 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758157015 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758167982 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758179903 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758209944 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758383989 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758394003 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758404016 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758413076 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758423090 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758433104 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758440018 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758476019 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.758889914 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758939981 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758949995 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.758985996 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.759068012 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.759077072 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.759087086 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.759121895 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.759121895 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.759152889 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.765341997 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.780076027 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844002962 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844017029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844022989 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844089031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844113111 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844181061 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844192028 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844198942 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844214916 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844255924 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844285965 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844285965 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844321966 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844333887 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844392061 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844531059 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844561100 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844571114 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844599009 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844650984 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844687939 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844729900 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844744921 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844775915 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844789982 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844834089 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844851017 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844861031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844885111 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844897032 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.844926119 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.844937086 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845005989 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845017910 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845032930 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845079899 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845093012 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845187902 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845199108 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845202923 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845208883 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845248938 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845267057 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845304012 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845345974 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845367908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845371962 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845452070 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845479012 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845489979 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845509052 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845519066 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845529079 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845597029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845606089 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845686913 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845700026 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845704079 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845707893 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845737934 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845761061 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845819950 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845829964 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845840931 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.845860004 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.845881939 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846024990 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846035004 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846057892 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846067905 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846081018 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846086979 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846102953 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846183062 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846210003 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846221924 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846240997 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846267939 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846343040 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846353054 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846363068 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846373081 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.846381903 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.846411943 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849042892 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849055052 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849066019 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849097013 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849159002 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849169016 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849179029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849191904 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849196911 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849248886 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849330902 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849342108 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849354982 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849359035 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849363089 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849379063 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849399090 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849431992 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849442959 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849453926 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849468946 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849478960 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849486113 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849529982 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849543095 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849611998 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849622965 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849684000 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849736929 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849745989 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849771023 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849781036 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849787951 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849797964 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849838018 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849838018 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849864960 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849879026 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849900007 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849910021 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849920034 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.849925995 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.849957943 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850114107 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850174904 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850186110 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850192070 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850229979 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850238085 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850307941 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850308895 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850313902 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850353956 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850370884 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850451946 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850462914 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850475073 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850483894 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850493908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850502968 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850511074 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850581884 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850595951 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850640059 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850789070 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850800037 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850811005 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850838900 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850847960 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850857973 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850867987 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850878000 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850893974 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.850946903 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.850989103 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.851017952 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851027966 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851037979 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851066113 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.851141930 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851152897 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851164103 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851178885 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.851212025 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.851219893 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851229906 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851278067 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.851363897 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851373911 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.851418972 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.860052109 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.864924908 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.864936113 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.864976883 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.864985943 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865031004 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865057945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865103960 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865113020 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865192890 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865196943 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865240097 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865251064 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865324020 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865331888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865358114 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865365982 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865433931 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865442038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865483999 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865494013 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865550995 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865560055 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865586042 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865593910 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865652084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865667105 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865684032 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.865691900 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.932075977 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.932086945 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.932172060 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.933854103 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.933862925 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.933873892 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.933911085 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.933923960 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.933960915 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.933984995 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.933995008 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934005976 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934041023 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934137106 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934146881 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934158087 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934166908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934189081 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934216022 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934274912 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934284925 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934295893 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934309006 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934319019 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934334040 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934513092 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934529066 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934539080 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934549093 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934560061 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934568882 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934576035 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934585094 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934592962 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934607983 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934637070 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934683084 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934767962 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934782028 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934829950 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934880018 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934890032 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934900999 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934909105 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934936047 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934936047 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.934981108 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.934990883 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935004950 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935020924 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935036898 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935064077 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935074091 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935084105 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935138941 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935235977 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935245991 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935256004 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935265064 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935275078 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935292006 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935302019 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935308933 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935333014 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935362101 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935420036 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935520887 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935544014 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935554028 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935565948 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935575008 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935585022 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935607910 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935637951 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935772896 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935782909 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935792923 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935802937 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935812950 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935822964 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935830116 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935830116 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.935839891 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.935884953 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936059952 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936080933 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936091900 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936101913 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936111927 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936124086 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936129093 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936137915 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936146975 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936153889 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936163902 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936175108 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936192989 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936213970 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936589956 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936600924 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936613083 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936623096 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936634064 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936647892 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936655998 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936665058 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936675072 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936685085 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936691046 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936700106 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936709881 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936719894 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936731100 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936737061 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936737061 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936743021 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936753988 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.936775923 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.936794996 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937215090 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937225103 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937233925 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937243938 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937253952 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937262058 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937272072 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937280893 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937294960 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937309027 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937316895 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937316895 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937349081 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937515020 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937525988 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937547922 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937560081 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937568903 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937578917 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937588930 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937598944 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937606096 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937618017 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937653065 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937664032 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937673092 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937686920 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937700987 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937711000 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937717915 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937726974 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937740088 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937760115 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937771082 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937777996 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937784910 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937803984 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937808037 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937808990 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937819958 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937833071 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.937848091 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937848091 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.937900066 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.938514948 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938525915 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938536882 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938548088 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938559055 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938565016 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.938575029 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938584089 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.938591957 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938599110 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:39.938611031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:39.938651085 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021472931 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021492958 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021502018 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021560907 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021575928 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021589041 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021600008 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021626949 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021641970 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021691084 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021697044 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021738052 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021823883 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021832943 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021869898 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021878958 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021888018 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021898031 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.021934032 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.021934032 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022116899 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022125959 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022139072 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022147894 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022157907 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022169113 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022178888 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022185087 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022192001 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022201061 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022208929 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022255898 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022402048 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022434950 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022445917 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022456884 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022496939 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022496939 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022516966 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022526979 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022536993 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022546053 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022557020 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022583961 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022600889 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022671938 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022733927 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022741079 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022754908 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022799969 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022823095 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022833109 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022842884 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022851944 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.022864103 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.022890091 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.023066044 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023085117 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023094893 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023103952 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023113966 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023123026 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023138046 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023144960 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.023154020 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023164988 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023174047 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.023225069 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.023380995 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023416996 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023427010 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.023444891 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.023475885 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.495439053 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.502867937 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.591126919 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.596018076 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.769721985 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.840764999 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.865746975 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:40.872730017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872744083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872766018 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872775078 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872783899 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872792959 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872802019 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872809887 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872818947 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872827053 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872848988 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872857094 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872864962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872873068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872884035 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872889996 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872890949 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872891903 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872895956 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872904062 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872915983 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872931957 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872940063 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872948885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872956991 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872965097 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872972012 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:40.872981071 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.540962934 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.545785904 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.607065916 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.611866951 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.785048962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.858999968 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.863965988 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.863977909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864032984 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864042044 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864051104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864058971 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864114046 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864124060 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864146948 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864155054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864188910 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864226103 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864233971 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864242077 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864276886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864285946 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864351988 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864360094 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864454985 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864463091 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.864473104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.970326900 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.975215912 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975228071 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975285053 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.975307941 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975323915 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975362062 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975375891 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:41.975389004 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975486994 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975495100 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975560904 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.975570917 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980278969 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980292082 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980321884 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980333090 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980343103 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980351925 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980650902 CET	4444	49926	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:41.980761051 CET	49926	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:42.557332993 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:42.562206984 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.611624002 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:42.616426945 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.790328026 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.853703022 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:42.861248970 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:42.866154909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866167068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866277933 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866286993 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866307974 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866317034 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866327047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866355896 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866472960 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866482019 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866516113 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866523981 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866532087 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866540909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866642952 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.866652012 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.870846033 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.870855093 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.870903969 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.870913029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:42.870922089 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.615427971 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:43.618988991 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:43.620227098 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.623819113 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.797265053 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.843715906 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:43.861176014 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:43.866210938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866225004 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866241932 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866259098 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866323948 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866337061 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866379023 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866424084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866503954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866525888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866584063 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866592884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866664886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.866681099 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.870899916 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.870946884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.870991945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871051073 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871084929 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871140003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871180058 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871233940 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871248960 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871301889 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871339083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871392965 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:43.871408939 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:44.704349995 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:44.704577923 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:44.709117889 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:44.709343910 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:44.883548975 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:44.949249029 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:45.119420052 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:45.124305010 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124316931 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124375105 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124383926 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124423027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124432087 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124479055 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124488115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124532938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124541044 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124614954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124624014 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124670029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124677896 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124723911 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124733925 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124768972 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124777079 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124819994 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124829054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124866962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124876022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124922991 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.124931097 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.128995895 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.129004955 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.129014015 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.722124100 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:45.722315073 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:45.727067947 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.727145910 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.900019884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.952825069 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:45.957803011 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957815886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957834005 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957842112 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957859993 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957876921 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957959890 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.957968950 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958010912 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958019972 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958066940 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958075047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958113909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958122969 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958137989 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958165884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958195925 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958204031 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958255053 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958265066 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958307028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958316088 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958359957 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.958369017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.962538004 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.962549925 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.962567091 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:45.962575912 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.300103903 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.311178923 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.316979885 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.317049026 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.317306995 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.322065115 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.429702997 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.732151031 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.732305050 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.737025976 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.737294912 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.910428047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.946088076 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:46.947355986 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:46.952186108 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.037936926 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:47.043029070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043041945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043059111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043067932 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043076038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043083906 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043093920 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043102026 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043114901 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043123007 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043162107 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043170929 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043185949 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043194056 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043243885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043252945 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043359041 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043366909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043382883 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043391943 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043406963 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043415070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043540955 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043550014 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043557882 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043566942 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.043575048 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.047669888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.142890930 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.145173073 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:47.150121927 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150135040 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150142908 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150259018 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150268078 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150310040 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.150319099 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.907289028 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:47.907459974 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:47.912544966 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:47.912699938 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.087302923 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.102689981 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:48.102724075 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.102797031 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:48.104562044 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:48.104597092 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.207771063 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:48.212867022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.212882996 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.212951899 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.212960958 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.212980032 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.212987900 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213051081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213063955 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213102102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213113070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213151932 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213196039 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213257074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213262081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213309050 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213316917 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213366032 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213382006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213408947 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213418007 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.213462114 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.767712116 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.771251917 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:48.771282911 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.771673918 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.773214102 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:48.773284912 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:48.939330101 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:48.939558983 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:48.944191933 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.944408894 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:48.965754986 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:49.032294989 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.037235975 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.037302971 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.037559032 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.042506933 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042521000 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042530060 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042538881 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042557955 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042567015 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042593002 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.042613983 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042623997 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042634010 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.042639971 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042649984 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.042674065 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.042704105 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.047543049 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047555923 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047574043 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047583103 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047621012 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.047667027 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.047818899 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047828913 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.047868967 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.089510918 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.089853048 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.119878054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.137556076 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.195575953 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.200495005 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200508118 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200519085 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200548887 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200623035 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200639963 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200674057 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200712919 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200833082 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200841904 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200850964 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200859070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200872898 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200886965 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200916052 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200923920 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200983047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.200992107 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.201042891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.201051950 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.201061010 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.492062092 CET	4444	49955	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.492248058 CET	49955	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.965277910 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.965477943 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:49.970117092 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:49.970258951 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.144943953 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.237152100 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:50.242039919 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242052078 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242100954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242110968 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242120028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242127895 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242141962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242150068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242178917 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242187977 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242233038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242242098 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242289066 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242296934 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242340088 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242347956 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242396116 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242408991 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242427111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242434978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242460966 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242469072 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242503881 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242511988 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242552042 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242559910 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242593050 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.242602110 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.458200932 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.559585094 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:50.647613049 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:50.652554989 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.652565956 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.652574062 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.652602911 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.966696024 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:50.966758966 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:50.971591949 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:50.971652985 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.147902012 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.189332962 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:51.194361925 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194372892 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194494009 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194503069 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194547892 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194555998 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194610119 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194617987 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194636106 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194654942 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194691896 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194700003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194823027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194830894 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194880962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.194890022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195029020 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195036888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195046902 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195106983 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195115089 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195122957 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195142031 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195151091 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195198059 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195205927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195244074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.195250988 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.984679937 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:51.984798908 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:51.989566088 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:51.989613056 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.164623022 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.250044107 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:52.269987106 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:52.274967909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.274979115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275044918 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275062084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275106907 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275115013 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275140047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275147915 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275234938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275243998 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275275946 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275284052 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275340080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275348902 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275372028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275379896 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275432110 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275439978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275484085 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275492907 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.275501966 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.408170938 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.459064960 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:52.467067957 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:52.471926928 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.471936941 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.471976995 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.471986055 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472067118 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472075939 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472110033 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472117901 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472191095 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472199917 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472214937 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472242117 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472352982 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472362995 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472378969 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472387075 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:52.472431898 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.003895044 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:53.004264116 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:53.010909081 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.013061047 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.186105013 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.246953011 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:53.356743097 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:53.361846924 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361862898 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361881971 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361891031 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361927986 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361937046 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361964941 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361973047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.361995935 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362016916 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362046003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362054110 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362121105 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362128973 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362165928 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362174034 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362214088 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362225056 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362267017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362296104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362341881 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.362344980 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.486449957 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:53.486514091 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:53.486568928 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:53.543967962 CET	49954	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:53.543996096 CET	443	49954	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:53.958992004 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:53.961483955 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:53.966415882 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.014019966 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:54.014219999 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:54.018946886 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.019017935 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.191952944 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.234733105 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:54.239660978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239674091 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239690065 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239698887 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239726067 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239733934 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239811897 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239820957 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239877939 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239886999 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239897966 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239923954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239974976 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.239984035 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240060091 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240087032 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240103006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240129948 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240181923 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240190029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240210056 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240272999 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240282059 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240292072 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240307093 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.240315914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.795597076 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.796904087 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:54.803596973 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:54.803725004 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.095633984 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:55.095973969 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:55.186991930 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.187012911 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.368820906 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.413218021 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:55.456676960 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:55.461704969 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461730003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461739063 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461747885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461774111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461781979 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461822987 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461833954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.461961031 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462034941 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462131023 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462137938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462310076 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462318897 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462409973 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462425947 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462524891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462541103 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462587118 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462640047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462665081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.462734938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.466360092 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:55.466368914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.062262058 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.170679092 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:56.175503969 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.175525904 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.175537109 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.175658941 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.175668955 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.322578907 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:56.327394962 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.327903032 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:56.332726002 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.439690113 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:56.439699888 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:56.439763069 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:56.439934015 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:56.439944029 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:56.505763054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.600856066 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:56.605765104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605779886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605885029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605895042 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605906010 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605921984 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.605968952 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606045008 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606050014 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606050968 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606096029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606105089 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606153965 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606163025 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606215954 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606225967 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606266975 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606379986 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:56.606388092 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.078211069 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:57.080847979 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:57.080869913 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:57.081187963 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:57.084909916 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:57.084959030 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:02:57.168106079 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:02:57.341464043 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:57.346223116 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.386900902 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:57.391685963 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.568738937 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.647187948 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:57.652637959 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:57.657605886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657617092 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657624960 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657634020 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657643080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657658100 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657743931 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657752037 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657761097 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657766104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657798052 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657807112 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657854080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657890081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657958984 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.657968044 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.658107996 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:57.658116102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.341991901 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:58.346817017 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.396606922 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:58.401465893 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.574795961 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.644399881 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:58.785691023 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:58.790565968 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790587902 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790669918 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790685892 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790736914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790745974 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790822983 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790832043 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790857077 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790889978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790898085 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790947914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.790956974 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791040897 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791049004 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791093111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791145086 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791198969 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791238070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791285038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791333914 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:58.791346073 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.357841969 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:59.362839937 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.406932116 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:59.412921906 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.586216927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.651690006 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:59.720093966 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:59.724994898 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725008011 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725047112 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725061893 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725086927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725095034 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725153923 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725164890 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725208044 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725217104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725296021 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725303888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725312948 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725353003 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725362062 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725394964 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725472927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725553036 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725723028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725733042 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.725742102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.980894089 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.988807917 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:02:59.993617058 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:02:59.993766069 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.363373995 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:00.368268013 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.413578987 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:00.418358088 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.591758966 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.661313057 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:00.666209936 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666229963 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666248083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666351080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666359901 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666408062 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666419029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666507959 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666516066 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666568041 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666575909 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666585922 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666656017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666703939 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666712999 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666748047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666799068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666896105 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:00.666903973 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:01.804646015 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:01.804723978 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:01.805236101 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:01.819993973 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:01.820178032 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:01.824759960 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:01.824975014 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.035979986 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.151294947 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:02.152201891 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156171083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156179905 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156191111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156207085 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156260967 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156274080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156344891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156353951 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156367064 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156377077 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156420946 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156430006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156485081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156492949 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156502962 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156511068 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156536102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156570911 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156656027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156733036 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.156742096 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.215631962 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:02.220463037 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.582808018 CET	49981	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:02.582839966 CET	443	49981	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:02.903404951 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:02.903492928 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:02.908164024 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:02.908238888 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.083326101 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.136271954 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:03.141160965 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141170979 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141220093 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141241074 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141324997 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141333103 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141374111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141417027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141427994 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141463995 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141473055 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141550064 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141557932 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141597986 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141606092 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141649008 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141700029 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141729116 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141752005 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141799927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141839027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.141884089 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.907892942 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:03.908040047 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:03.912715912 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:03.912837982 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.019053936 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.019206047 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.019275904 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.087371111 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.152878046 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.327289104 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.332252026 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332262993 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332308054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332324028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332442045 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332452059 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332535028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332544088 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332559109 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332566023 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332611084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332623959 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332668066 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332676888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332704067 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332711935 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332814932 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332823038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332834005 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332843065 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.332942009 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.335767031 CET	49947	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.340523958 CET	4444	49947	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.686355114 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.686425924 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.924623966 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.925010920 CET	49913	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:04.929409981 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:04.929800987 CET	4444	49913	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.103013039 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.147494078 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:05.203449011 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:05.208345890 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208376884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208579063 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208594084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208625078 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208633900 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208676100 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208684921 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208728075 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208741903 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208753109 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208760977 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208796978 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208805084 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208817005 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208848953 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208978891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.208987951 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.209002018 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.209012032 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.209064960 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.209153891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.209177971 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:05.394395113 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:05.394433975 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:05.394567966 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:05.394736052 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:05.394757032 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:05.935947895 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:05.940813065 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.050183058 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:06.050570011 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:06.050581932 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:06.050863981 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:06.051215887 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:06.051289082 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:06.101150036 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:06.114619017 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.184514999 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:06.189392090 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189404011 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189424038 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189431906 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189528942 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189548016 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189651012 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189660072 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189697027 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189701080 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189778090 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189785957 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189827919 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189836025 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189898014 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.189920902 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.190001965 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.190011024 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:06.190052986 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.108309984 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:07.113152027 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.285769939 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.328612089 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:07.333589077 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333653927 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333739042 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333748102 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333802938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333811045 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333846092 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333899021 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333908081 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333916903 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333933115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333946943 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333978891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.333991051 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.334017992 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.334026098 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.334140062 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:07.334148884 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.249596119 CET	49724	80	192.168.2.4	199.232.214.172
Jan 4, 2025 00:03:08.254617929 CET	80	49724	199.232.214.172	192.168.2.4
Jan 4, 2025 00:03:08.254661083 CET	49724	80	192.168.2.4	199.232.214.172
Jan 4, 2025 00:03:08.298437119 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:08.303275108 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.487894058 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.540798903 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:08.569680929 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:08.574515104 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574573040 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574583054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574599028 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574610949 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574621916 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574630976 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574677944 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574704885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574722052 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574732065 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574742079 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574820995 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574830055 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574839115 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574846983 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:08.574915886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.304662943 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:09.309555054 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.489834070 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.651576042 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:09.909264088 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:09.914241076 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914253950 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914271116 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914279938 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914290905 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914319992 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914330006 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914361000 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914401054 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914460897 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914469004 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914477110 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914514065 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914522886 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914554119 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914561987 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.914773941 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:09.989321947 CET	4444	49733	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.107521057 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:10.259654045 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:10.264575005 CET	4444	49908	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.437963009 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.511320114 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:10.517227888 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517240047 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517250061 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517282963 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517322063 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517330885 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517371893 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517380953 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517436981 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517445087 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517503977 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517512083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517522097 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517529964 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517591953 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517601013 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517644882 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517689943 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517723083 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517765045 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.517896891 CET	4444	49909	185.234.72.215	192.168.2.4
Jan 4, 2025 00:03:10.711834908 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:10.711863041 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:10.711957932 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:10.712852955 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:10.712863922 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:10.769951105 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:10.770005941 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:10.770107985 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:11.133523941 CET	50055	443	192.168.2.4	13.107.246.67
Jan 4, 2025 00:03:11.133544922 CET	443	50055	13.107.246.67	192.168.2.4
Jan 4, 2025 00:03:11.367448092 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:11.367665052 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:11.367686987 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:11.368005037 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:11.368468046 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:11.368526936 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:11.563163042 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:11.784476042 CET	49733	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:11.785022974 CET	49735	80	192.168.2.4	178.237.33.50
Jan 4, 2025 00:03:11.785109043 CET	49908	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:11.785366058 CET	49909	4444	192.168.2.4	185.234.72.215
Jan 4, 2025 00:03:21.265772104 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:21.265841007 CET	443	50095	142.250.185.196	192.168.2.4
Jan 4, 2025 00:03:21.265991926 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:23.095864058 CET	50095	443	192.168.2.4	142.250.185.196
Jan 4, 2025 00:03:23.095875025 CET	443	50095	142.250.185.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 00:02:02.524585962 CET	58047	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:02.531586885 CET	53	58047	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:06.423626900 CET	53	57197	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:06.828476906 CET	53	59903	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:07.829596996 CET	53	50029	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:09.774959087 CET	51454	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:09.775155067 CET	63557	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:10.661782980 CET	56997	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:10.661973000 CET	56376	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:10.668348074 CET	53	56997	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:10.668957949 CET	53	56376	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:10.807359934 CET	61427	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:10.807563066 CET	50734	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:15.271979094 CET	53	58703	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:16.023082018 CET	50419	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:16.023247004 CET	57303	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:02:20.336659908 CET	138	138	192.168.2.4	192.168.2.255
Jan 4, 2025 00:02:25.107408047 CET	53	55949	1.1.1.1	192.168.2.4
Jan 4, 2025 00:02:44.175673008 CET	53	54641	1.1.1.1	192.168.2.4
Jan 4, 2025 00:03:05.850291967 CET	53	63028	1.1.1.1	192.168.2.4
Jan 4, 2025 00:03:07.092926979 CET	53	55863	1.1.1.1	192.168.2.4
Jan 4, 2025 00:03:16.027097940 CET	51976	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:03:16.027177095 CET	62609	53	192.168.2.4	1.1.1.1
Jan 4, 2025 00:03:37.211400032 CET	53	53625	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 4, 2025 00:02:07.516011000 CET	192.168.2.4	1.1.1.1	c2e3	(Port unreachable)	Destination Unreachable
Jan 4, 2025 00:02:09.887711048 CET	192.168.2.4	1.1.1.1	c2b4	(Port unreachable)	Destination Unreachable
Jan 4, 2025 00:02:10.841929913 CET	192.168.2.4	1.1.1.1	c2e3	(Port unreachable)	Destination Unreachable
Jan 4, 2025 00:03:11.509022951 CET	192.168.2.4	1.1.1.1	c2e3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 00:02:02.524585962 CET	192.168.2.4	1.1.1.1	0x2a3f	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:09.774959087 CET	192.168.2.4	1.1.1.1	0x9791	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:09.775155067 CET	192.168.2.4	1.1.1.1	0x8ab	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jan 4, 2025 00:02:10.661782980 CET	192.168.2.4	1.1.1.1	0x4713	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:10.661973000 CET	192.168.2.4	1.1.1.1	0xc28c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 4, 2025 00:02:10.807359934 CET	192.168.2.4	1.1.1.1	0x286	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:10.807563066 CET	192.168.2.4	1.1.1.1	0xb2af	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Jan 4, 2025 00:02:16.023082018 CET	192.168.2.4	1.1.1.1	0xf8ad	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:16.023247004 CET	192.168.2.4	1.1.1.1	0x9dcf	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Jan 4, 2025 00:03:16.027097940 CET	192.168.2.4	1.1.1.1	0x2007	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:03:16.027177095 CET	192.168.2.4	1.1.1.1	0x69ac	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 00:02:02.531586885 CET	1.1.1.1	192.168.2.4	0x2a3f	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:09.781842947 CET	1.1.1.1	192.168.2.4	0xca57	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.781842947 CET	1.1.1.1	192.168.2.4	0xca57	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.781842947 CET	1.1.1.1	192.168.2.4	0xca57	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782346010 CET	1.1.1.1	192.168.2.4	0x8ab	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782346010 CET	1.1.1.1	192.168.2.4	0x8ab	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782888889 CET	1.1.1.1	192.168.2.4	0x9791	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782888889 CET	1.1.1.1	192.168.2.4	0x9791	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782888889 CET	1.1.1.1	192.168.2.4	0x9791	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:09.782888889 CET	1.1.1.1	192.168.2.4	0x9791	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:09.887655020 CET	1.1.1.1	192.168.2.4	0x5b5b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.668348074 CET	1.1.1.1	192.168.2.4	0x4713	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:10.668957949 CET	1.1.1.1	192.168.2.4	0xc28c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 4, 2025 00:02:10.808276892 CET	1.1.1.1	192.168.2.4	0x2c77	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.808276892 CET	1.1.1.1	192.168.2.4	0x2c77	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.808276892 CET	1.1.1.1	192.168.2.4	0x2c77	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:10.808479071 CET	1.1.1.1	192.168.2.4	0x7bc3	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814021111 CET	1.1.1.1	192.168.2.4	0x286	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814021111 CET	1.1.1.1	192.168.2.4	0x286	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814021111 CET	1.1.1.1	192.168.2.4	0x286	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814021111 CET	1.1.1.1	192.168.2.4	0x286	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814847946 CET	1.1.1.1	192.168.2.4	0xb2af	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:10.814847946 CET	1.1.1.1	192.168.2.4	0xb2af	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:16.031270981 CET	1.1.1.1	192.168.2.4	0x9dcf	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:16.031327963 CET	1.1.1.1	192.168.2.4	0xf8ad	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:17.595170021 CET	1.1.1.1	192.168.2.4	0x6892	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:17.597938061 CET	1.1.1.1	192.168.2.4	0x6bc5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:20.690104008 CET	1.1.1.1	192.168.2.4	0xf9e5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:20.705367088 CET	1.1.1.1	192.168.2.4	0xbc6b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:56.725841045 CET	1.1.1.1	192.168.2.4	0xe39	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:02:56.725841045 CET	1.1.1.1	192.168.2.4	0xe39	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:03:16.035183907 CET	1.1.1.1	192.168.2.4	0x2007	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:03:16.038311005 CET	1.1.1.1	192.168.2.4	0x69ac	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:03:20.184211016 CET	1.1.1.1	192.168.2.4	0xf4d9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:03:20.184211016 CET	1.1.1.1	192.168.2.4	0xf4d9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 4, 2025 00:03:52.321527958 CET	1.1.1.1	192.168.2.4	0x6f0f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 4, 2025 00:03:52.321527958 CET	1.1.1.1	192.168.2.4	0x6f0f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

js.monitor.azure.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	178.237.33.50	80	7188	C:\Users\user\AppData\Roaming\Graias\graias.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 00:02:02.551342964 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jan 4, 2025 00:02:03.166555882 CET	1171	IN	HTTP/1.1 200 OK date: Fri, 03 Jan 2025 23:02:03 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	13.107.246.67	443	7744	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 23:02:10 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-03 23:02:10 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 23:02:10 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 275be117-b01e-0006-4a05-581325000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20250103T230210Z-156796c549btxqbfhC1EWR2hbg0000000ssg0000000070ep x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-01-03 23:02:10 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2025-01-03 23:02:10 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Target ID:	0
Start time:	18:01:54
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\iGhDjzEiDU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\iGhDjzEiDU.exe"
Imagebase:	0xb70000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1688374211.0000000004149000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1688374211.0000000004185000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:01:57
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\iGhDjzEiDU.exe"
Imagebase:	0xd10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	18:01:57
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	18:01:57
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\iGhDjzEiDU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\iGhDjzEiDU.exe"
Imagebase:	0x370000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	18:01:57
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\iGhDjzEiDU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\iGhDjzEiDU.exe"
Imagebase:	0x510000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000005.00000002.1682584731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	18:01:58
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Graias\graias.exe"
Imagebase:	0x510000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	18:02:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\Graias\graias.exe"
Imagebase:	0xd10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	18:02:00
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Graias\graias.exe"
Imagebase:	0xb10000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	18:02:00
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	18:02:00
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	18:02:01
Start date:	03/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	18:02:04
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	18:02:04
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2000,i,13104816673025473941,13422850102401617178,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	18:02:09
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	18:02:09
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2052,i,5101334319077942357,3031038982098258924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	18:02:10
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	18:02:12
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	18:02:13
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=2016,i,6952115490064793543,9344193390170368015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	18:02:16
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	18:02:16
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,6037255309931644860,773684642686352873,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	18:02:17
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	18:02:21
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	18:02:21
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1988,i,6741851451867710431,3176181943120798108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	18:02:22
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	18:02:28
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	29
Start time:	18:02:28
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1984,i,6477219484691926715,17097649623628388741,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	18:02:31
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	18:02:31
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1956,i,397094272896585161,9213667926170046926,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	18:02:31
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	18:02:33
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\dxdiag.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\dxdiag.exe" /t C:\Users\user\AppData\Local\Temp\sysinfo.txt
Imagebase:	0x5a0000
File size:	222'720 bytes
MD5 hash:	24D3F0DB6CCF0C341EA4F6B206DF2EDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	18:02:35
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	18:02:35
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1984,i,15953286615006375795,524760772625708092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Imagebase:	0x140000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Imagebase:	0x20000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\epwvcdsubpgsncdkmqhibndmvhurqgg"
Imagebase:	0x8f0000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\orbocvcopxyxxqzovbukeapdendakrxtoq"
Imagebase:	0xe80000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	40
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Imagebase:	0x1c0000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	41
Start time:	18:02:39
Start date:	03/01/2025
Path:	C:\Users\user\AppData\Roaming\Graias\graias.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Graias\graias.exe /stext "C:\Users\user\AppData\Local\Temp\rlggdon"
Imagebase:	0xb70000
File size:	983'040 bytes
MD5 hash:	7CAF240DB905F259197CF71B03ACF888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	42
Start time:	18:02:40
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	43
Start time:	18:02:40
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1896,i,8025100827868505226,8846340673771724363,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	44
Start time:	18:02:41
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	45
Start time:	18:02:43
Start date:	03/01/2025
Path:	C:\Windows\System32\drivers\mstee.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	12'288 bytes
MD5 hash:	244C73253E165582DDC43AF4467D23DF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	46
Start time:	18:02:43
Start date:	03/01/2025
Path:	C:\Windows\System32\drivers\mskssrv.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	34'816 bytes
MD5 hash:	26854C1F5500455757BC00365CEF9483
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	47
Start time:	18:02:46
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	48
Start time:	18:02:47
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1988,i,14003735333465884459,4249736709750483152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	49
Start time:	18:02:51
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	50
Start time:	18:02:51
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1996,i,9861328130371480487,5472941936562496665,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	51
Start time:	18:02:51
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	52
Start time:	18:02:54
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	53
Start time:	18:02:55
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1980,i,14451717029141036046,9817444519185968189,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	54
Start time:	18:02:58
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	55
Start time:	18:02:59
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1980,i,13194812879482372137,17589311234174251836,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	56
Start time:	18:02:59
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	57
Start time:	18:03:04
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	58
Start time:	18:03:04
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1980,i,4041789208375361090,5104077722080206453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	59
Start time:	18:03:07
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	60
Start time:	18:03:07
Start date:	03/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1900,i,964775095578921725,9120990377794690672,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	61
Start time:	18:03:07
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x3a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	62
Start time:	18:03:09
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\xyepttayrhgkznkxmawzcpzmosukc.vbs"
Imagebase:	0x2b0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true